[Snort-sigs] Netsky.c + others? attachment sid

John B. cybergolfing at ...144...
Wed Mar 3 12:43:02 EST 2004


Sorry for the confusion Hugo.
When I say Trusted_Smtp_Server, I don't mean that the
only thing it does is send _and_ receive email. Yes, I
have application servers that send email via SMTP but
never have a reason to receive email.  And, 9 chances
out of 10, they would not show up on a network scan
looking for port 25 open because SMTP is not static on
them.

I consider those as trusted because I'm expecting
email from them. I'm not familiar with "hosting
networks" so I guess my view is somewhat
biased/skewed.

John B.

--- Hugo van der Kooij <hvdkooij at ...481...>
wrote:
> On Wed, 3 Mar 2004, John B. wrote:
> 
> > If 192.168.1.10 normally sends logrotate emails to
> > 192.168.1.2, would it not then be a trusted SMTP
> > server also?
> 
> Frankly? No. It will use SMTP to forward daily
> reports but it will not
> receive SMTP at all. This is a common setup in many
> hosting networks as
> well.
> 
> Hugo.
> 
> -- 
>  All email sent to me is bound to the rules
> described on my homepage.
>     hvdkooij at ...481...	
> http://hvdkooij.xs4all.nl/
> 	    Don't meddle in the affairs of sysadmins,
> 	    for they are subtle and quick to anger.
> 
> 
>
-------------------------------------------------------
> SF.Net is sponsored by: Speed Start Your Linux Apps
> Now.
> Build and deploy apps & Web services for Linux with
> a free DVD software kit from IBM. Click Now!
>
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
>
https://lists.sourceforge.net/lists/listinfo/snort-sigs


__________________________________
Do you Yahoo!?
Yahoo! Search - Find what you’re looking for faster
http://search.yahoo.com




More information about the Snort-sigs mailing list