OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Snort SMTP expn-root
From: Oxenreider, Jeff (joxSAFELITE.COM)
Date: Thu Jul 06 2000 - 07:24:14 CDT

Last night at around 7pm EST I got these two log entries from my IDS server.

Jul 5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
-> XXX.XXX.XXX.10:25
Jul 5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
-> XXX.XXX.XXX.10:25

Weird thing is that originating IP address is "lists.securityfocus.com".
I've been on these lists for over a month and this is the first time I've
ever seen this message come up in my IDS.

Anyone know why this may occur that I'm missing?

Jeffrey A. Oxenreider
Network Security Analyst
Safelite Glass Corp