[Snort-users] pop: Unknown POP3 response/command

Matteo De Rosa matteo.derosa at ...17411...
Fri Dec 18 10:43:29 EST 2015


I have just installed snort and I observe a lot of false (I suppose) positive. I start from this:

 < Signature > 	 < Classification > 	 < Total # > 	 Sensor # 	 < Source Address > 	 < Dest. Address > 	 < First > 	 < Last > 
      	[snort] pop: Unknown POP3 response	protocol-command-decode	2962(0%)	1	37	

Source address is correctly our mail-server. Dest address are our LAN client.
Can it a version problem from server and client ?
But, the thing that is close to my heart: how can i ack this event and don't see in BASE web front-end ?

Thanks to all for any contribution

Matteo


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20151218/be92f09d/attachment.html>


More information about the Snort-users mailing list