|
strange mail connections: msg#00039security.intrusions
We have the strangest thing happening in our network. The one incoming mail server is receiving zillions of full TCP connections from IP addresses that should not normally connect directly to the email server. The connection is past to the upper session layers as SMTP connections. The connections are established but "no message data" is present or sent in the packet. The volume/amount of these connections is causing degradation of the server in that it fills the smtp connection table thus not allowing new connections. Is there a new/old attack that could be doing this? _________________________________________________________________ Need more storage? Upgrade to suit your needs - from 10 MB to 100 MB! http://join.msn.com/?pgmarket=en-xe _______________________________________________ Intrusions mailing list Intrusions@xxxxxxxxxxxxxx http://www.dshield.org/mailman/listinfo/intrusions |
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| Previous by Date: | repeated entries with multiple '&'s in URI query of GETs in IIS l ogs: 00039, Weiler, Jim |
|---|---|
| Next by Date: | LOGS: GIAC GCIA Version 3.4 Practical Detect Jose Faial: 00039, José Faial |
| Previous by Thread: | repeated entries with multiple '&'s in URI query of GETs in IIS l ogsi: 00039, Weiler, Jim |
| Next by Thread: | Re: strange mail connections: 00039, Maxime Ducharme |
| Indexes: | [Date] [Thread] [Top] [All Lists] |
| News | FAQ | advertise |