Re: Snort SMTP expn-root

[billp () ROCKETCASH COM (Bill Pennington)]

The expn-root detect looks for the string expn root in incoming SMTP
traffic. In this case the messages flying around about the tin.it guys
caused the alert.

"Oxenreider, Jeff" wrote:
> Last night at around 7pm EST I got these two log entries from my IDS server.
>
> Jul  5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
> -> XXX.XXX.XXX.10:25
> Jul  5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
> -> XXX.XXX.XXX.10:25
>
> Weird thing is that originating IP address is "lists.securityfocus.com".
> I've been on these lists for over a month and this is the first time I've
> ever seen this message come up in my IDS.
>
> Anyone know why this may occur that I'm missing?
>
> Jeffrey A. Oxenreider
> Network Security Analyst
> Safelite Glass Corp

--

Bill Pennington
Senior IT Manager
Rocketcash
billp () rocketcash com
http://www.rocketcash.com