Snort mailing list archives
RE: Capture Spam mail traffic using snort
From: <lokesh.khanna () accelonafrica com>
Date: Wed, 30 Mar 2005 07:23:54 +0100
Thanks. But is there any other way. If Spammer sends less than 10 mail in 60 sec, then snort will not be able to capture that. Is there any way to generate Alert based on content in Mail, or header of mail? Cordially, Lokesh -----Original Message----- From: Jason [mailto:security () brvenik com] Sent: 30 March 2005 06:59 To: Lokesh Khanna Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Capture Spam mail traffic using snort if those systems are in your network you could try a threshold rule alert tcp !$SMTP_SERVERS any -> any 25 (msg"possible spammer"; content:"rcpt to\:"; nocase; flow:to_server, established; threshold:type both, track by_src, count 10, seconds 60; sid:1000000; rev:1;) That rule should alert on any system that sends 10 mails in 60 seconds except those defined as SMTP_SERVERS. lokesh.khanna () accelonafrica com wrote:
Hi I am using snort on Redhat box. Is it possible to capture IP addresses using snort which are sending Spam mails. If yes, how can I get signature? Cordially, Lokesh
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_ide95&alloc_id396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Capture Spam mail traffic using snort lokesh.khanna (Mar 29)
- Re: Capture Spam mail traffic using snort Jason (Mar 29)
- <Possible follow-ups>
- RE: Capture Spam mail traffic using snort lokesh.khanna (Mar 29)
- Re: Capture Spam mail traffic using snort Jason (Mar 29)
- RE: Capture Spam mail traffic using snort Jose Maria Lopez Hernandez (Mar 30)