[Snort-users] Spamming

Len Conrad LConrad at ...3685...
Wed Oct 3 08:00:05 EDT 2001


>Ca we stop spamming using snort??? If yes how can it be done, I know that 
>commercial Intrusion Detection Systems, are able to do it, can it be done 
>with the open Source software, or limit the number of sessions that each 
>IP can use on a certain port

The best defense against SMTP abuse is an SMTP relay gateway.  See IMGate 
in my sig. It's free, and used by a few 100 ISP's and others with great 
success.

I don't think you´d like to burden snort with blocking a dictionary attack 
at a rate of 30K msgs/hour from 100's of ip's, as IMGate has been doing for 
one ISP for the last 3 weeks.

Len


http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com  : Build free, hi-perf, anti-abuse mail gateways





More information about the Snort-users mailing list