spoofed mail

["Per Engelbrecht" <per@xterm.dk>]

Hi misc@

Lately I've recived spam-complaints on our 'abuse@' on ip-addresses
from within one of our ranges/allocations (an old deprecating /20)
The 'funny' part is that these ip-addresses are not in use i.e. don't
have a nic attached to it.

We have all the serveres in a large datacenter (my "domain") where I
use obsd for a lot of tasks.  One of these tasks is a obsd-watchdog-box
on each networksegment (switched network) running a small piece of c
code to detect hosts going into promiscuous mode and ettercap+ethereal
for network analyzies. Don't have any pf between the gateway and the
customers servers, hence the approach with the watchdogs.

The problem is that I can't find the shit-head[s] doing it!
Any help is appreciated. Thank you.

respectfully
/per
per@xterm.dk

[demime 0.98d removed an attachment of type application/octet-stream]