[Snort-users] RE: smtp scans
jtmyfj at ...892...
Thu Nov 30 16:15:41 EST 2000
Ok, figured it out.
Dshield.org and portscan.cablemodem.com are affiliated. I was testing the
Dshield firewall reporting script on my IDS box. Due to a perl script
error, I sent a test message without a return address. The MailServer at
126.96.36.199 handles mail for both sites. It attempted to respond to my
message based on my IP address, hence the smtp attempts.
Sorry for the confusion.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users