Re: Spamming

[Len Conrad <LConrad () Go2France com>]

> Ca we stop spamming using snort??? If yes how can it be done, I know that 
> commercial Intrusion Detection Systems, are able to do it, can it be done 
> with the open Source software, or limit the number of sessions that each 
> IP can use on a certain port

The best defense against SMTP abuse is an SMTP relay gateway.  See IMGate 
in my sig. It's free, and used by a few 100 ISP's and others with great 
success.

I don't think you´d like to burden snort with blocking a dictionary attack 
at a rate of 30K msgs/hour from 100's of ip's, as IMGate has been doing for 
one ISP for the last 3 weeks.

Len


http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com  : Build free, hi-perf, anti-abuse mail gateways


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users