topic Re: SMTP question in Network Security https://community.cisco.com/t5/network-security/smtp-question/m-p/1120460#M896818 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>I looks like a ack on a mail comming ind, but if you are shure that you get all mails, I would do a network sniffing to see the tcp option bits, this will telle you more and you will se the session.</P><P></P><P>/Soren</P></BODY></HTML> Sat, 06 Sep 2008 12:13:05 GMT knudsen-s 2008-09-06T12:13:05Z SMTP question https://community.cisco.com/t5/network-security/smtp-question/m-p/1120459#M896816 <P>I have two mail relay servers (running brightmail) in our DMZ which accept inbound and send outbound mail. Everything works fine and has been working fine for a long time. However I do see a lot of Denied traffic from these servers, sourcing on port 25 with a random dst port (by a lot I mean a few every second). What would cause that? I'm not having any mail flow problems, but I'm just wondering if this is a problem I should worry about.</P><P></P><P>This is an example of the deny log (I replaced our local relay servers IP with "localip" and the target public ip with "publicip":</P><P></P><P>09-04-2008 15:19:57 Local4.Warning 10.15.1.254 Sep 04 2008 15:19:56: %ASA-4-106023: Deny tcp src Outside-Servers:localaddress/25 dst outside:remoteaddress/58496 by access-group "server-acl" [0x0, 0x0]</P> Mon, 11 Mar 2019 13:40:13 GMT https://community.cisco.com/t5/network-security/smtp-question/m-p/1120459#M896816 niro 2019-03-11T13:40:13Z Re: SMTP question https://community.cisco.com/t5/network-security/smtp-question/m-p/1120460#M896818 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>I looks like a ack on a mail comming ind, but if you are shure that you get all mails, I would do a network sniffing to see the tcp option bits, this will telle you more and you will se the session.</P><P></P><P>/Soren</P></BODY></HTML> Sat, 06 Sep 2008 12:13:05 GMT https://community.cisco.com/t5/network-security/smtp-question/m-p/1120460#M896818 knudsen-s 2008-09-06T12:13:05Z