I was notified by my isp that one of my machines is sending out spam. This happened about 3 months ago on windows machine running cygwin that was hacked due to an SSH vuln.

The hackers setup IIS and SMTP. I cleared out the machine and all the services are disabled so I think that machine is okay

I am wondering if there is any other way to identify which machine it could be coming from?

The ISP has NO useful information such as source port, destination port, destination IP... nothing.

I am running DD-WRT on my router, Windows 7 PC and a Windows XP PC.


You could connect a hub in between the router and your LAN and then plug a computer into the hub and install a traffic monitor on it such as Microsoft network monitor or wire shark


You will then be able to monitor all that goes on and set up filters etc

  • On my DD-WRT router I have a default outgoing deny policy and then open up specific ports from specific IP addresses, and obviously I open up common ports to all IPs such as 80, 443 etc Mar 16 '10 at 23:10
  • +1 for wireshark. monitoring the network traffic would be the way i'd set about it.
    – Joe Taylor
    Mar 17 '10 at 19:14
  • there is also MS network monitor 3 which has much the same functionality, I couldnt post the link to it as I didnt have enough points :( Mar 17 '10 at 20:08

It's been a long time since I played with DD-WRT, but on most business-level routers they have the ability to write a log each time a firewall rule is matched.

I would create a firewall rule for Port 25 (assuming that the mass mailer is using the standard SMTP port) and get it to write a log with the source IP every time it happens. It should then be pretty easy to locate the culprit.

  • It's the only way to be sure.
    – Zoredache
    Mar 16 '10 at 21:41
  • 2
    @Zoredache, absolutally. And when you guage the price of rebuilding a machine after a nuke and the time taken to fix it, it makes much more economic sense to just re-image it. Especially once you factor in the potential cost to the company by letting an infected machine onto a corporate network. Mar 16 '10 at 21:57
  • +1 nuke that sucka :) ... and something constructive: If DD-WRT can do netflow that would be an alternative way to see who is sending a whole bunch of SMTP traffic
    – Zypher
    Mar 16 '10 at 22:10
  • 1
    +1, and you should be blocking outgoing port 25 from any machine except your mail server!
    – James
    Mar 16 '10 at 22:13
  • 1
    Annoying, for sure, but I'd rather be a little bit annoying than have spam coming from my network. I don't have a problem with personal email accounts - they can either relay through the corporate server or use port 587 to their provider's SMTP server
    – James
    Mar 16 '10 at 23:14

I am also not sure how to track without netflow or SNMP logging. But would recommend you just restrict outbound SMTP traffic to your mail server(s)

Below assumes a mail server IP of on the network

iptables -I FORWARD 1 -p tcp -s --dport 25 -j ACCEPT
iptables -I FORWARD 2 -p tcp -s --dport 25 -j REJECT

Install a network monitor or packet sniffer application to see what's going on in your network. You should then be able to figure out which workstation is sending out all the SMTP traffic. Good luck!


Give Wireshark a try -- that's what our company suggests to folks when we report such issues to them:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy