Unsupported SMTP Parameter - Meaning?

[dalechavez]

The following entry is in my router log:

3-SMTP_UNSUPPORTED_PARAMETER: Unsupported SMTP parameter

According to Cisco documentation:

The CBAC code has detected an invalid or unsupported parameter in an SMTP command. The parameter "@ or # to ETRN" means that the initiator is trying to send an invalid etrn command. This message is for informational purposes only, but may indicate a security problem.

So exactly does it mean?

Thanks!

[a.arndt]

This looks like someone is trying to perform SMTP reconnaissance against a system somewhere behind your router (I'm assuming we're seeing an IOS IDS alert here...).

There's some info on the "IPS Alert Center" site that might help. Check this out:

http://www.cisco.com/cgi-bin/front.x/ipsalerts/view.pl?VID=1184

It describes the situation fairly well, even though the info is related to mainstream Cisco IDS/IPS alerts using the full list of Cisco SigIDs...

I hope this helps,

Alex Arndt