Re: Blocking mass mailings caused by viruses

POP uses port 110, not 25. It's not clear from your message whether you
provide SMTP services to everyone and they just POP their messages, or if
you allow them to connect to any SMTP server that they need. If the first
case, you can still block port 25 from all but your SMTP servers. If the
second, I'd recommend implementing the first case, if possible. That said,
many desktop AV programs can alert you if there are XXX number of outgoing
messages per minute (or maybe it was per second?) so I'm sure there's an
enterprise solution that does the same.

Rod Barnhart



On 10/12/05, Erdahl, Larry E <Larry.Erdahl@allina.com> wrote:
> Over the past month we've been blacklisted by Spamhaus several times
> because of infected workstations and laptops (contractors and
> consultants) sending out mass mailings.
> My management doesn't want to block port 25 because we have a handful of
> physicians who are using POP mail. Does anyone know of an IDS, IPS,
> firewall, router ACLs, etc... that will block outgoing SMTP traffic,
> based on abnormal traffic volume?
>
> Thanks in advance!
>
> Larry E. Erdahl
> IS Security Specialist
> Allina Hospital & Clinics
> Office (612)775-1273
> Cell (612)804-7324
> larry.erdahl@allina.com