[prev in list] [next in list] [prev in thread] [next in thread] 

List:       issforum
Subject:    [ISSForum] Blackice Server: TCP_Probe_SMTP normal on mail server?
From:       Cycle Rider <lamoto4 () yahoo ! com>
Date:       2004-09-13 23:23:27
Message-ID: 20040913232327.10380.qmail () web41306 ! mail ! yahoo ! com
[Download RAW message or body]

I didn't get any responses to this so please forgive
me for posting it again.  I'm desperate for some
answers.

I'm running blackice server (newest version) on a mail
server and using it to block dictionary attacks based
upon the smtp error message.

I am seeing hundreds of servers showing up in blackice
server as a TCP probe to port 25 on the mail server.

I need to know if it's normal for a mail server
talking to my mail server to trigger the probe
message?

Does anyone know how blackice determines that this is
a probe to port 25 rather than normal smtp activity?

Those of you running blackice on a mail server, did
you disable to automatic blocking of these probe
attempts?

Thanks for any help you can offer!


		
__________________________________
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail
_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to \
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 \
Barfield Road, Atlanta, Georgia, USA 30328.


[prev in list] [next in list] [prev in thread] [next in thread]