RE: ATTACK-RESPONSES id check returned root

[Paul Schmehl <pauls () utdallas edu>]

--On Monday, October 24, 2005 17:33:56 -0600 Our World Is Here 
<info () lucretia ca> wrote:

> I see this so often I've revised this sid (498 I think) to ignore anything
> coming via POP port 110.  If I see it on 25 I get worried...
Why?  If you see it on port 25, it's just incoming email.  Look at the 
payload.  You'll see that it's an email passing through your stmp server.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users