Project

General

Profile

Actions

Bug #5491

closed

SMTP response 530 appears to generate an SMTP invalid response alert

Added by Orion Poplawski about 2 years ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

We have a public facing mail server and we see a lot of SMTP invalid reply alerts when it issues a response like:

530 5.7.0 Must issue a STARTTLS command first
221 2.0.0 Bye

Now, I suppose this is indication of a failed attempt to send mail through it, but it’s not really an “invalid reply” and it’s not unexpected.


Related issues 1 (0 open1 closed)

Related to Suricata - Optimization #6821: smtp: add 535 codeClosedPhilippe AntoineActions
Actions

Also available in: Atom PDF