Re: [Snort-inline-users] Question SMTP Rules

[xyon <xy...@in...>]

Dropping an SMTP connection in midstream really isn't a good idea. I would 
suggest configuring your MTA to reject the message with some sort of 
notification (ie, "SPAM dropped").

Spamassassin is another solution.

On Monday 04 August 2008 13:24:44 ismain wrote:
> Hello
>  
> can you please tell me what I do wrong.
> I hereby would like block email message because of the content in Subject.
>  
> drop tcp  $EXTERNAL_NET any -> SMTP_SERVERS 25 (msg:"WORD  GO
> ";flow:to_server,established;content:"Subject|3A|";nocase;pcre:"/GO/i";sind
>1001004;rev:1;) 
>  
> thanks
>
>
>      
> ___________________________________________________________________________
>__ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente
> http://mail.yahoo.fr



-- 

xyon