Auto-deny hack attempts are made by checking line length. For instance, anything over 1024 characters during a standard SMTP transaction not in data mode is considered to be a hack attempt. As there is no valid commands under SMTP that allow for a line that long. This is adjusted by protocol. For DSN transactions the allowable length is 8k. So, what Scott says is right, it probably wasn't a virus that triggered it, but if it was the auto-deny you'll have to stop and start the service to remove the IP from the in-memory table.
Bob In reply to 4 Dec message from [EMAIL PROTECTED]: >You could also do a telnet session to the mail server >and see if any errors are returned. Best thing though >is to look in the log on your IMail server. >Eric S >----- Original Message ----- >From: "R. Scott Perry" <[EMAIL PROTECTED]> >To: <[EMAIL PROTECTED]> >Sent: Tuesday, December 04, 2001 9:48 AM >Subject: Re: [IMail Forum] Auto-deny possible hack >attempts >> >> >Does anyone know how Imail implements the "auto-deny possible hack >> >attempts" on the SMTP security? >> >> Yes. You check the box that says "Auto-deny possible hack attempts" on >the >> SMTP Security tab. >> >> >We have an IP number that is being refused access to port 25 on our Imail >> >server. >> >This IP number was assigned to a computer that received a virus. We have >> >cleaned >> >the virus and would like to unblock the IP number. Thanks for any help >> >you can give me. >> >> I believe you can't see the IPs that get listed, but stopping and >> restarting the SMTP service should clear the list (unlike the kill list, >> which won't get reset with a SMTP stop/restart). >> >> However, I haven't heard of a virus that will trigger the "Auto-deny >> possible hack attempts" (the Nimda one would, if it connected to the SMTP >> port the same way it connects to the HTTP port, but it doesn't connect to >> the SMTP port that way). So I would suspect there is another problem. >You >> might want to try having them do a ping or tracert/traceroute to your mail >> server, and see if they can reach it at all. >> >> You may also want to see if your firewall is doing the blocking. >> >> -Scott >> --- >> Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for >> IMail. http://www.declude.com >> >> >> Please visit http://www.ipswitch.com/support/mailing-lists.html >> to be removed from this list. >> >> An Archive of this list is available at: >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ >> >Please visit >http://www.ipswitch.com/support/mailing-lists.html to >be removed from this list. >An Archive of this list is available at: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
