Thats great for knowing who is using smtp properly, my question pertains to the duration of the connection PRIOR to any auth. I want to know who is connecting to port 25 and what they are doing. For instance, I suspect I have someone(s) connecting and not using auth trying to find local users...