On my customer site I have two networks 192.168.0.X and 192.168.1.X my 192.168.0.X side are all PC's connected to a domain. My 192.168.1.X are all macs who receive mail from my exchange server on port 1110 (as oppose to 110)
The two sites are connected by a zyxel prestige firewall with two ip alias 192.168.0.1 and 192.168.1.1
When I look at the logs there is a huge amount of traffic from mac 192.168.1.55 to my mailserver on port 1110 (it reports triangle route packet forwarded) and from my mailserver back to the mac. At first I thought the mac maybe set to retrieve mails every minute or so but surely this would not generate constant traffic?