jonathanduane2010
asked on
Exchange server causing sonicwall to crash
Hi,
I have an exchange server and one of the admins opened it up for anybody to connect and send email, i have (i think) locked it back down but it keep on flooding port 25 and router keeps crashing aswell as email, here is the log from the router
Firewall Event The cache is full; 6144 open connections; some will be dropped 192.168.0.13, 16088, LAN (admin) 209.191.88.254, 25, WAN
is there anyway i can get it to stop?? i have ran malwarebytes it didnt find anything
thank you
I have an exchange server and one of the admins opened it up for anybody to connect and send email, i have (i think) locked it back down but it keep on flooding port 25 and router keeps crashing aswell as email, here is the log from the router
Firewall Event The cache is full; 6144 open connections; some will be dropped 192.168.0.13, 16088, LAN (admin) 209.191.88.254, 25, WAN
is there anyway i can get it to stop?? i have ran malwarebytes it didnt find anything
thank you
ASKER
ok it was set to 15 mins i have set it to 2 mins
going to run wireshark now, but it looks like there are thousands of connections
going to run wireshark now, but it looks like there are thousands of connections
See if inactive timeout can be set per port number - a global setting will affect your other services
look at your connections monitor for port 25 - sift by total packets and drop the connections that are not passing traffic
notice if these connections are coming from the same networks.
also make sure you are using good RBL lists, barracuda, spamhuas, spamcop are some favorites
look at your connections monitor for port 25 - sift by total packets and drop the connections that are not passing traffic
notice if these connections are coming from the same networks.
also make sure you are using good RBL lists, barracuda, spamhuas, spamcop are some favorites
ASKER
the connections arent coming from the same network they seem to be the destination, the source seems to be the my local exchange server
i would try clearing smtp queue in exchange
malwarebytes has to be run in safemode - all the nastiest malwares detect all the malware scanners and pretty effectively hide themselves.
malwarebytes has to be run in safemode - all the nastiest malwares detect all the malware scanners and pretty effectively hide themselves.
Check your mail queues, it maybe outgoing email - you may have a spam bot on one of your workstations inside your network.
ASKER
where do i check the mail queues?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
i have exchange 2003, i have stopped relaying so relaying cant be done from the server
then block their traffic.
you may have a setting in your firewall for 'session timeout' for inactive connections
try decreasing this.