I get a security report from logwatch everyday, and of course, always browse through it. Recently, I noticed that I got quite a sh*tload of connections from 1 particular ip, about 4 hops from me (traceroute).

I'm pretty sure spammers can't relay through my server, but don't know what to think of these connections (200 times more than the other IPs).

Any toughts on that?

If you're sure it's not legitimate traffic, it would be a good idea to block that IP at your firewall.

You sure it's not a service monitor checking to make sure your SMTP service hasn't died?

Ahhh... Oops... I knew it had to be something simple that I'd missed :o

Thanks. It's indeed a monitoring service.