Re: [OT] odd network question

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]




On 02/08/2019 15:07, Fred Smith wrote:

and I didn't even mention the huge number of failed attempts on port
25. /var/log/maillog is full of systems trying to send spam, or trying
to DOS me with incompleted connection attempts, or just plain spamming
with mail for addresses not at this system. The little light on the
network switch serving this machine hardly ever stops blinking with all
the traffic hitting it.

One thing I don't understand is how/why the firewall is DROPping so
many attempts on port 25 when it in fact has a port forward rule
sending port 25 on to my mailserver. How does it know, or why does
it think that some of them can be dropped at the outer barrier?

Some spamming tools are just telnet with an expect script, lightweight and can be loaded onto embedded systems, e.g. other firewalls / modems etc...

A downside of using these tools is that telnet sets the PUSH TCP flag, so many firewalls (e.g. Cisco ASA) have protocol inspection for SMTP and signals the connection as invalid. if it uses the PUSH TCP flag, which a proper SMTP daemon wouldn't use for that protocol (PUSH flags ask the server to service the sent data, even if it hasn't finished with a CR/LF)

_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos



[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]


  Powered by Linux