SMTP traffic

From: <bron_at_gmail.com>
Date: 2 Jul 2007 03:01:15 -0000

('binary' encoding is not supported, stored as-is)  I am sort of new to IDS. I am writing rule for IPS. If i have a rule which requires monitoring the argument of Mail From : SMTP command, then it may happen that my rule can get triggered inside the body of emails giving me false positives.
 
 Any suggestions how can i remove such false positives ?

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
Received on Jul 03 2007