Hi All,
I am new at this and would appreciate some
direction. The following
was detected by my IDS sensor. The "email_turn"
event was recorded but
the source was the smtp server in my dmz and the
destination address was
an internal smtp server. A few questions:
1. What exactly is an Email_turn event?
2. What danger, if any, does this feature (smtp turn,
I'm guessing)
present on my internal smtp server
3. What do I lose by not allowing it. It is MS
Exchange 5.5.
Thanks in advance.
\d
___________________________________________
_________
'Email_Turn' event detected by the
RealSecure 'myids' at
'xxx.xxx.xxx.xx'.
Details:
Source Address: xxx.xxx.xxx.xxx Source
Port: 2244
Source MAC Address: xx:xx:xx:xx:xx:xx
Destination Address: xxx.xxx.xxx.xxx
Destination Port: E-mail (25)
Destination MAC Address: xx:xx:xx:xx:xx:xx
Time: 2002-03-14 23:54:42 UTC
Protocol: TCP (6)
Priority: low
Actions:
DISPLAY=Default:0,LOGDB=LogWithoutRaw:0,EMAI
L=email-level-1:0
Event Specific Information:
