From owner-freebsd-questions@FreeBSD.ORG  Sat Mar 21 15:15:26 2015
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id E1B27877
 for <freebsd-questions@freebsd.org>; Sat, 21 Mar 2015 15:15:26 +0000 (UTC)
Received: from mail-ig0-x22c.google.com (mail-ig0-x22c.google.com
 [IPv6:2607:f8b0:4001:c05::22c])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id A577C137
 for <freebsd-questions@freebsd.org>; Sat, 21 Mar 2015 15:15:26 +0000 (UTC)
Received: by igcau2 with SMTP id au2so8251529igc.1
 for <freebsd-questions@freebsd.org>; Sat, 21 Mar 2015 08:15:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=message-id:date:from:user-agent:mime-version:to:subject
 :content-type:content-transfer-encoding;
 bh=heaUfP/9C9zKjyXIbZmXG/3HM5XzR8mkMiYDD8r5N4U=;
 b=LnCID8qRLdxwtK2JotVqDc4lOxTcZXHnLjmyQm44706h3Gp3MMTWPyWsHVDAZl+Wil
 C8Lgg4jyQ77bDFcmup2RuVN0RI1Ew5ofT9Y49PgiN2hySRsG8TMrww18+uaRo30DmtiV
 0w/DiVMhqbdhesl5wCGO1TWLA2bPMMF6M/yOz70bds8br5dX3i2EjFBv2YA7cPS1dCXj
 PeJEK2eL9MG9OjhMet8dtv37Iss+jQnHTDvNSiia0YUYXy32ZgNV4Wzmi1/L5mNFyhma
 9e2fryoTesl6DzjqRmUlzPMjjbNhh85b+FbDWn+IWLh8nj6N5km+MKjhWQ9dFFYn7biP
 Vi9w==
X-Received: by 10.107.13.144 with SMTP id 138mr154225262ion.24.1426950925993; 
 Sat, 21 Mar 2015 08:15:25 -0700 (PDT)
Received: from [10.0.10.1] (cpe-76-190-244-6.neo.res.rr.com. [76.190.244.6])
 by mx.google.com with ESMTPSA id qd2sm1428284igc.22.2015.03.21.08.15.25
 for <freebsd-questions@freebsd.org>
 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
 Sat, 21 Mar 2015 08:15:25 -0700 (PDT)
Message-ID: <550D8B0E.2020406@gmail.com>
Date: Sat, 21 Mar 2015 11:15:26 -0400
From: Ernie Luzar <luzar722@gmail.com>
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
MIME-Version: 1.0
To: FreeBSD Questions <freebsd-questions@freebsd.org>
Subject: 10.0 system issuing outbound packets to port 25 smtp to 66.96.214.197
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Mar 2015 15:15:27 -0000

My ipfilter firewall logs 2 outbound packets on port 25 every 70 
minuets.  There is no LAN behind this box is it must be coming from the
freebsd 10.0 system or from one of the official installed ports I have.
Sendmail is disabled and postfix is running in it's place.

66.96.214.197,25 tcp is the target public ip address.

How should I go about finding the running task that is doing this???