I see a lot of traffic going out from our qmail server to a remote SMTP
Jun 6 09:32:45 <firewall> kernel: >> IN= OUT=eth1 SRC=<firewall-IP>
DST=<external mail server> LEN=576 TOS=0x00 PREC=0x00 TTL=64 ID=43106
PROTO=TCP SPT=44759 DPT=25 WINDOW=5840 RES=0x00 ACK URGP=0
There are more than 10 of these transmissions per second, for quite a long
time (actually still going on untill I blocked this traffic in the
firewall). This seems to be comming from my smtp server, and I'm a little
bit worried now.
Has anybody seen something like this before? Is it possible that my mail
server is compormised?