[Snort-users] ATTACK-RESPONSES id check returned root

Paul Schmehl pauls at ...6838...
Tue Oct 25 14:51:24 EDT 2005


--On Monday, October 24, 2005 17:33:56 -0600 Our World Is Here 
<info at ...2282...> wrote:

> I see this so often I've revised this sid (498 I think) to ignore anything
> coming via POP port 110.  If I see it on 25 I get worried...
>
Why?  If you see it on port 25, it's just incoming email.  Look at the 
payload.  You'll see that it's an email passing through your stmp server.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/




More information about the Snort-users mailing list