Automaticly getting the IP of a Virus Sender?

[Randal, Phil]

Karl M. Joch wrote:

> Hello,
>
> I was looking to add a script to automaticly block IPs of
> Virus senders in the firewall. Is there any way to run a
> script when finding a Virus, or Spam, getting the sender IP
> in a variable? All of our servers updates the firewall from a
> central point and the blocks are removed every night. This
> would help against mass mail viruses alot. I know this can be
> dangerous when blocking some ISPs mail server but maybe this
> helps that some ISPs blocks some traffic at their servers
> too. Finally the ISP mail server will retry to send the
> emails for a loger time, but mails from a workstation having
> a virus are mostly sent direct and not queued somewhere which
> will bring the traffic and the system load for virus scanning down.

Vispan does this by blocking the virus sender's IP in your
Sendmail "access" file.

See http://www.while.homeunix.net/mailstats/

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html