SMTP Relaying bug

[Pauling <pauling () Starwolf biz>]

Has anybody noticed this, that the Alert for an SMTP relay attack monitors 
the 550 RELAING DENIED message, and as such, gives a misleading 
notification implying that your server is attempting to send mail through 
a closed relay.

I'm not very good at writing snort rules, but is there any way to 
efectively reverse this, so that the alert reads that a mail message from 
$EXTERNAL_NET was not relayed through $SMTP_SERVERS

-- 
Frank Barton
Starwolf.biz Systems Administrator



-------------------------------------------------------
This SF.NET email is sponsored by: FREE  SSL Guide from Thawte
are you planning your Web Server Security? Click here to get a FREE
Thawte SSL guide and find the answers to all your  SSL security issues.
http://ads.sourceforge.net/cgi-bin/redirect.pl?thaw0026en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users