This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS Dropping Connections from Exchange Server

Hi everyone,

Our email setup hasn't changed.  The exchange server uses the  Astaro as a smart host which relays outgoing mail.  No outgoing scanning is turned on.

While looking through our Astaro today to solve other issues, I can across some interesting messages in the IPS Live Log showing that my exchange server is attempting to communicate with my Astaro (I assume it is relaying emails as normal) and IPS is dropping these connections.

Here is the error from the  IPS log (I've placed x for privacy):

2011:01:20-13:27:41 main snort[5240]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="" reason="(smtp) Attempted response buffer overflow: 963 chars" group="0" srcip="***.***.***.***(Mail Server)" dstip="***.***.***.***(Astaro)" proto="6" srcport="25" dstport="35342" sid="0" class="Attempted User Privilege Gain" priority="1" generator="124" msgid="1"

This error message seems to happen every 1-2 minutes in the log.  Mail seems to be coming in and going out as normal so it's not crucial but I don't like seeing my logs fill up with constant errors for the same thing.

Has anyone come across this before?  If no fix, should I just disable yet another IPS rule?

Thanks in Advance.

This thread was automatically locked due to age.

0 Scott_Klassen over 14 years ago

On the Advanced Tab in IPS, have you added your Exchange server to SMTP Servers under Performance Tuning by chance?

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 JBoslooper over 14 years ago

Hi Scott,

Yes I have put all of the respective servers in each Performance Tuning category. My Exchange is listed under SMTP.
Cancel
Vote Up 0 Vote Down

Cancel
0 profesor over 14 years ago

try; turnOFF antiDos/flooding
reboot ASG
Cancel
Vote Up 0 Vote Down

Cancel
0 JBoslooper over 14 years ago

Profesor,

I do not have anti-dos/flooding under IPS turned on currently.
Cancel
Vote Up 0 Vote Down

Cancel
0 Redist over 14 years ago in reply to JBoslooper

I have the same issue with Exchange 2007
Cancel
Vote Up 0 Vote Down

Cancel
0 t-work over 14 years ago in reply to Redist

We have the same issue here with Exchange 2007 with the only difference in
"reason": reason="(smtp) Attempted response buffer overflow: 783 chars"

Problem exists since "Upgrade" from 7.5X to 8.003 (8.1X is unusable for us at the moment)

As the snort id is marked as "0", I don't think disabling this id is a good idea.

A little research some weeks ago made me believe that this concerns emails being sent FROM Astaro SMTP proxy TO the Exchange server, where answer-packets from the exchange server are blocked / triggered the rule (" action="" " probably means there is no action taken?)

Most of the time mails are sent successfully. But take care: at ours they were sometimes not, resulting in THAT.

Fun. [:@]
Cancel
Vote Up 0 Vote Down

Cancel