Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Traffic summary report generates "unknown@unknown" in InterScan Messaging Security Virtual Appliance (IMSVA) 9.1

    • Updated:
    • 18 Jun 2019
    • Product/Version:
    • Interscan Messaging Security Virtual Appliance 9.1
    • InterScan Messaging Security Virtual Appliance 9.1
    • Platform:
    • N/A N/A
Summary

The generated IMSVA traffic summary report shows the top email address by traffic is "unknown@unknown". This address has no entries as it cannot be found under Logs > Query > Message Tracking. It cannot be added on the block list as well, showing an invalid domain error.

Details
Public

"Unknown@unknown" that shows up in IMSVA reports is for blank sender addresses. IMSVA looks/logs the SMTP envelope addresses for their report. If you are familiar with sending emails through telnet command, below is a typical format of commands that a sending MTA sends to receiving MTA.

telnet MTA_IP or FQDN 25
helo/ehlo
MAIL FROM: sender@domain.com
RCPT TO: recipient@domain.com
DATA
From: Sender@Domain.Com
To: Recipient@Domain.Com
Subject: Test email

This is message body or content.
.

The addresses in MAIL FROM: and RCPT TO: commands are the SMTP envelope addresses. These are the ones logged/recorded by IMSS in reports.

The addresses in From: and To: headers after the DATA command are the message headers. These are the addresses displayed and the addresses you see once you received the email.

Generally and is the case in MOST MTA's, NDR mails, and DSN mails, and sometimes email read receipts as well as OOO (Out of Office) messages (in the case of MS EXchange for example) are sent with a blank MAIL FROM: address. Thus, IMSVA will have no address to put in the logs/reports for those emails. So IMSVA simply consolidates them to one category which is unknown@unknown.

Premium
Internal
Rating:
Category:
Configure
Solution Id:
1122953
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.