From owner-freebsd-questions@FreeBSD.ORG  Thu Aug 18 16:42:15 2011
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id D782A106564A
	for <freebsd-questions@freebsd.org>;
	Thu, 18 Aug 2011 16:42:15 +0000 (UTC) (envelope-from cswiger@mac.com)
Received: from asmtpout027.mac.com (asmtpout027.mac.com [17.148.16.102])
	by mx1.freebsd.org (Postfix) with ESMTP id BF6968FC0A
	for <freebsd-questions@freebsd.org>;
	Thu, 18 Aug 2011 16:42:15 +0000 (UTC)
MIME-version: 1.0
Content-transfer-encoding: 7BIT
Content-type: text/plain; CHARSET=US-ASCII
Received: from cswiger1.apple.com ([17.209.4.71])
	by asmtp027.mac.com (Oracle Communications Messaging Exchange Server
	7u4-18.01 64bit (built Jul 15 2010)) with ESMTPSA id
	<0LQ40018YUEEJA50@asmtp027.mac.com>
	for freebsd-questions@freebsd.org; Thu, 18 Aug 2011 09:42:15 -0700 (PDT)
X-Proofpoint-Virus-Version: vendor=fsecure
	engine=2.50.10432:5.4.6813,1.0.211,0.0.0000
	definitions=2011-08-18_06:2011-08-18, 2011-08-18,
	1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0
	ipscore=0 suspectscore=0 phishscore=0 bulkscore=0 adultscore=0
	classifier=spam
	adjust=0 reason=mlx engine=6.0.2-1012030000 definitions=main-1108180153
From: Chuck Swiger <cswiger@mac.com>
In-reply-to: <CAJxePN+HU3_8_ELie0NPXMNd9OS1=_MuHJnhPNFRScOTb=A+yw@mail.gmail.com>
Date: Thu, 18 Aug 2011 09:42:14 -0700
Message-id: <F318D000-CCFF-4AFA-8CCD-B3AD70392BED@mac.com>
References: <CAJxePNKiEmdimqgdtS-jYPOxExL6a489SR5JW2kCd25X6QFuHQ@mail.gmail.com>
	<D49826AA-9FF9-4848-A92A-5FF29A78679B@mac.com>
	<CAJxePNJ6k=0Na0Zcz7_j4EAs3QNHOSnSENp3AWVdfiirV_h_pA@mail.gmail.com>
	<033753EAA5A5EE53C17333A5@utd71538.utdallas.edu>
	<CAJxePN+HU3_8_ELie0NPXMNd9OS1=_MuHJnhPNFRScOTb=A+yw@mail.gmail.com>
To: alexus <alexus@gmail.com>
X-Mailer: Apple Mail (2.1084)
Cc: freebsd-questions@freebsd.org
Subject: Re: looking for a spammer/virii/malware .... on my system
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Aug 2011 16:42:15 -0000

On Aug 18, 2011, at 9:36 AM, alexus wrote:
> su-3.2# tcpdump -nnAvvvw webmail.west.cox.net 'dst host 68.6.19.1 and
> (dst port 80 or 443)'
> tcpdump: listening on bce0, link-type EN10MB (Ethernet), capture size 96 bytes
> Got 0
> 
> let's see what I capture...

You're going to capture traffic of people reading webmail from Cox.net.

However, as much as that might be interesting, it is not useful
for detecting outbound spam from a machine or network....

Regards,
-- 
-Chuck