OT: Linux question

[Bob Thomason]

Since some of you on this list are linux gurus, I'm posting the following request.

I have a client who is running a linux firewall and email is passing thru to a backend email server (btw I support the fw server).  Email server is Lotus Notes.....I think.  So the firewall is not logging email traffic except for outgoing (port 25).

The problem is that my client has over 100 machines on their lan.......some in remote locations ....and they have had a problem(s) with virus/malware issues on one or more machines.

What we are looking for is a way to track email traffic that will allow us to identify traffic to a machine that may be suspicoius.

The logs from the internal email server are not sufficient.

Any suggestions?

Regards,
Bob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.celestial.com/pipermail/filepro-list/attachments/20110614/b6fc958a/attachment.html