[Snort-users] I'd rather not get the message
janderso at ...3530...
Tue Jun 4 17:11:19 EDT 2002
I've got a mail gateway that notifies users when their messages get blocked,
usually for obscene content, executable attachments, etc. It was
misconfigured and started sending out notifications to senders of mail
coming in. My goof. Looks like it picked up on your attachment, scan-msgs,
because there was no file extension. Anyway, there should be no more
notifications sent out. Again, I apologize for the misconfiguration and
wasting your time,
I'll pick option 2, thanks
Computer Services Manager
"Don't worry about people stealing your ideas. If your ideas are any good,
you'll have to ram them down people's throats."
-- Howard Aiken
From: matt [mailto:mkettler at ...4108...]
Sent: June 3, 2002 9:19 AM
To: Phil Wood; snort at ...3530...
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] I'd rather not get the message
If you are referring to the message "Re: [Snort-users] portscsan.log
summary." I'd agree, that attachment is perfectly valid. There is no
suspicious extension, and no virus code present, no reason other than
accidental misconfiguration or blatant "wrong headedness" to block the
I personally suspect accidental misconfiguration (ie: a list of allowed and
denied extensions that is buggy when there is no extension at all.) as I
find it hard to believe any mail admin intentionally block text-formatted
perl script attachments. There are a lot of wrong-headed sysadmins out
there (ie myself) but I find that one more wrong-headed than I would belive.
At 09:28 PM 6/1/2002 -0600, Phil Wood wrote:
>I sent a perfectly valid message and attachment to the snort list in reply
>to a query for help. Apparently, your software will not let this type of
>mail in. So, it would seem to me you have two options:
> 1. unsubscribe from the snort-users at lists.sourceforge.net mailing list.
> 2. Don't bother sending us helpful folks messages we can do nothing
> and are completely, and utterley uninterested in.
>Thanks, but no thanks.
>Phil Wood, cpw at ...440...
>Don't miss the 2002 Sprint PCS Application Developer's Conference
>August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users