SMTP Spam coming from Hotspot Clients

[ryanslimmon]

I'm sure someone's run across this before and has some ideas on how to track this down. Lately, i've been getting a few messages about spam coming from one of our IP addresses, of course this turns out to be the hotspot server (external address). Of course they don't get me the real header stating which internal address it came from.

I thought of just using SMTP Roaming, but I think this would create an issue where the sending spam would get redirected through our mail server and it would look like our server was sending spam. Depending on the volume (which I am unsure of at this point), i could turn that feature on for a few minutes to see what happens and if i can track it down.

The other thing that came to mind was to turn on SMTP roaming and point the mail to a non function address so no one can use SMTP. Of course this would cut off the legit customers that are using email properly.

So i guess there is a couple of ways to figure this out and deal with it, however I am unsure of the following:

1) How can I log traffic on a specific port (i.e. smtp)
2) Can Firstspot block all traffic on a port except to a white list of hosts
3) I could just ignore the emails about spam coming from that ip, but usually that leads to blocks and possible subnet blocks.

Any ideas?