<html><head></head><body>Why are using the action "reject" in your signature as opposed to "drop". The action "reject" is essentially the same as sending a reset so you are telling the bad guy that you are alive. By using the action "drop", you are just dropping the packets but not giving the other end a response. Maybe they are still hitting you because you are telling them that you are alive.<br><br><font size="4" face="Arial">Leonard Jacobs, MBA, CISSP, CSSA<br></font><div><font size="3" face="Arial">President/CEO</font></div><div><font size="3" face="Arial">Netsecuris Inc.</font></div><div><font size="3" face="Arial">Office 952-641-1421</font></div><div><font size="3" face="Arial">http://www.netsecuris.com</font></div><br><br><br><div><strong>
From:
</strong>
Mesra.net CEO <admin@mesra.my>
<br>
<strong>
To:
</strong>
<oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
3/8/2017 12:59 PM
<br>
<strong>
Subject:
</strong>
[Oisf-users] Mail Attack Rules
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;">
<div>
<div style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial'; COLOR: #000000">
<div>Dear All,</div>
<div> </div>
<div>Since few days ago my server has been attack and the attacker are sending
thousands of emails to invalid email username and its only effected to 1 domain
name, currently i have to block more then 10k IPs per day for the issue,
with suricata i make the rules like below but that will totally block the access
for valid emails, is theres any tips i can make the rules for more flexible for
example the suricata only block any access to invalid email from out of the
list, for example i will list down all the valid receipent emails and the others
will automatically block:</div>
<div> </div>
<div>reject tcp any any -> any [25,587,465] (msg:"***** BLOCK ABCDE.com EMail
ATTACK *****"; dsize:>0; content:"@abcde.com"; sid:51; rev:1;)</div>
<div> </div>
<div>Please help, TQ</div>
<div> </div>
<div> </div></div></div>
<br><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br></blockquote></div></body></html>