It's normal SMTP traffic. SMTP mail flows from client high port to server 25. An email server sending email to another server acts like a client. If you don't allow your high port to connect to another server's port 25, you won't be able to send any email.
Matt Simonsen wrote: > I am seeing traffic regularly coming from remote servers' port 25 > destined to our servers' high ports, generally in the 1-3k range. Is > this normal? I plan to block it all, from what I understand SMTP goes > only from 25 to 25, but if that's the case I can't figure out what this > would be. > > According to our IPFilter logs the traffic generally has -AFP set, > please let me know off-line if a tidbit of info I could provide can help > you answer my question. > > Thanks > Matt Simonsen >
