This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Constant Intrusion Protect Alert

I keep getting the following message

Intrusion Protection Alert

Details about the intrusion alert:

Message........: SMTP expn cybercop attempt
Details........: http://www.snort.org/pub-bin/sigs.cgi?sid=632
Time...........: 2006:04:30-21:45:03
Packet dropped.: yes
Priority.......: 3 (low)
Classification.: Generic Protocol Command Decode
IP protocol....: 6 (TCP)

The source ip is my firewall while the destination ip is my email server. First it would get delivered to the admin address, now it gets caught in my proxy content manager.

I get 5 every 30 minutes. Can someone tell me why this just started happening and how I can get it to stop?

Thanks

This thread was automatically locked due to age.

0 openfield over 19 years ago in reply to BarryG

Hi,
I've the same problem... Constant email with "intrusion protection alert".
This happen when users (Entourage on Mac and myself with Outlook Web Access) connect to my mail server [[:(]]
For the moment, I turn off the notification of "high severity alert" but..... [[:(]]
I've an ASL 6.201 (this problem appears after upgrading to 6.201 I think...) and my mailserver is an Exchange 2003 SP2.
I'm waiting for a fix [;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 Gert Hansen over 19 years ago in reply to openfield

Hi there all,

why don't you go into the IPS ruleset and disable the rule that triggers false positives.

With the Hit counter inside the ruleset you can easily identify which are the rules that get hit most frequently.
You can reset the counters by clicking on the number.

hope that helps,
Regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel