RE: SMTP Scans

[Jimi Thompson <jimit () myrealbox com>]

At 4:40 PM +0200 4/22/03, Mally Mclane wrote:
> Hi,
>
> --On Monday, April 21, 2003 6:50 PM -0400 Rob Shein 
> <shoten () starpower net> wrote:
>
> > For the last few months our ISP (BT) has apparently been scanning our
> > mail  servers for open relays, this is happening up to
> > 12 times a day across both Primary & Secondary mail servers.
>
> I don't condone this, but this is fairly common practice amongst UK ISPs.
>
> Regards,
>
>
> Mally Mclane
> RIPE NCC - Operations

Why the aggressive schedule?  For your "commercial" (as in - not end 
user) IP space, I would think that weekly or monthly should be 
sufficient.  Especailly considering that, as your ISP, they know the 
IP addresses of your mail servers, I find this to be excessive and 
would really like to know what they think they are combating.  It 
sounds like another bean counter making technical decisions again.

> ----------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Europe, May 12-15 in 
> Amsterdam, the world's premier event for IT and network security 
> experts.  The two-day Training features 6 hand-on courses on May 
> 12-13 taught by professionals.  The two-day Briefings on May 14-15 
> features 24 top speakers with no vendor sales pitches.  Deadline for 
> the best rates is April 25.  Register today to ensure your place. 
> http://www.securityfocus.com/BlackHat-incidents 
> ----------------------------------------------------------------------------


--
Thanks,

Ms. Jimi Thompson, CISSP, Rev.

"I'm a great believer in luck, and I find the harder I work, the more 
I have of it." -- Thomas Jefferson


----------------------------------------------------------------------------
Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the 
world's premier event for IT and network security experts.  The two-day 
Training features 6 hand-on courses on May 12-13 taught by professionals.  
The two-day Briefings on May 14-15 features 24 top speakers with no vendor 
sales pitches.  Deadline for the best rates is April 25.  Register today to 
ensure your place. http://www.securityfocus.com/BlackHat-incidents 
----------------------------------------------------------------------------