SMTP relay server tagged by IDS
"Walzer, Jeff" <[email protected]> Thu, 11 Aug 2005 10:08:21 -0400
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
Our SMTP relay server is being tagged by our IDS with the TCP SYN Host Sweep on Same Dest Port alert. Here is the raw message: xxx.xxx.xxx.xxx/3307 --> 12.129.199.35/0 TCP TCP SYN Host Sweep On Same Dest Port,NR-3030/0,Risk Rating:21 The weird thing is that the destination port is 0 - is this standard behavior and a false positive or something I should dig deeper into? Thanks... The information contained in this message and any attachments (collectively, the "Transmission") from Dick's Sporting Goods, Inc. contains confidential information and is intended solely for the named recipient(s). If you are not a named recipient, you are prohibited from copying, distributing or using this Transmission. Please contact the sender immediately by returning the e-mail and deleting the original Transmission. _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions