SMTP Service creating packet flood

HWhite · Joined: 06 Aug 2007 Posts: 1

I have a Windows 2000 Small Business Server running Exchange 2000. A new
issue has arisen a couple of days ago. After much troubleshooting, I've
discovered that when the smtp service on my server is started, after
approximately a minute, the external NIC on my server becomes flooded with
packets. This lasts for approximately 5-6 minutes and then subsides for
about a minute and then resumes with the packet flood. All internet related
traffic suffers as a result and I can't figure out how to stop this behavior.
I've changed network cards, I changed the slot the card is installed in,
I've checked for viruses that may be present. I've checked the smtp queue
and it is empty. I'm thinking this might be some sort of DOS attack on port
25, but I'm not sure. I did a packet capture on the external NIC and
analyzed the date. All the traffic is coming from a single IP address
(38.118.132.70). Can anybody offer any suggestions on how to approach this?

Archived from group: microsoft>public>exchange2000>protocols

Leif Pedersen [MVP] · Joined: 05 Aug 2007 Posts: 193

Hi,

Sounds as if someone is trying to use your server as a relay:

http://www.msexchange.org/tutorials/MF005.html
http://www.vamsoft.com/authattack.asp

If there are no queues in the SMTP queue they are not successfull, but no
harm in checcking the above articles. There is not much else you can do.

Leif

"HWhite" wrote in message @microsoft.com...
>I have a Windows 2000 Small Business Server running Exchange 2000. A new
> issue has arisen a couple of days ago. After much troubleshooting, I've
> discovered that when the smtp service on my server is started, after
> approximately a minute, the external NIC on my server becomes flooded with
> packets. This lasts for approximately 5-6 minutes and then subsides for
> about a minute and then resumes with the packet flood. All internet
> related
> traffic suffers as a result and I can't figure out how to stop this
> behavior.
> I've changed network cards, I changed the slot the card is installed in,
> I've checked for viruses that may be present. I've checked the smtp queue
> and it is empty. I'm thinking this might be some sort of DOS attack on
> port
> 25, but I'm not sure. I did a packet capture on the external NIC and
> analyzed the date. All the traffic is coming from a single IP address
> (38.118.132.70). Can anybody offer any suggestions on how to approach
> this?

SMTP Exchange Server 2007 b2 - smtp connector doesnt work Hi, In exchange 2003 our organization set up an external smtp relay in the SMTP protocol of the server complete with ip and login. In exchange 2007 the protocol access is removed. However there is a SMTP connector section in hub transport. We configured t

SMTP Exchange Server 2007 b2 - smtp connector doesnt work Hi, In exchange 2003 our organization set up an external smtp relay in the SMTP protocol of the server complete with ip and login. In exchange 2007 the protocol access is removed. However there is a SMTP connector section in hub transport. We configured t

Pop3 Service not starting All other Exchange 2000 services has started. However, when I try to start the POP3 service I receive a message that says "Could not start the Microsoft Exchange POP3 service on the local computer;" followed by this error 1053: The service did not respon

POP3 Service Not starting.. Hello, I have installed a new w2k3 domain controller and joined anothe w2k3 server to this domain and installed exchange 2k3 in the member server. If i am trying to start the POP3 virtual server, the POP3 service is not starting itgives the following erro

exchange 2003 service pack 2 local delivery queue retry I have a client thats running SBS 2003 with all the service packs installed. They are not receiving emails and the local drlivery queue is backed up. How do I get the messages to deliver to the users mail boxes? Thanks! Mark S. Daly