TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
With the vast amount of false positives I recieve in my environment, I do
not have it set to kill.. there are too many false positives for that. I
suggest watching it closely and filtering out the false positives, and then
setting it to kill.
-----Original Message-----
From: Verne Baxter [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, August 22, 2001 1:09 PM
To: '[EMAIL PROTECTED]'
Subject: RealSecure 6.0 rskill question
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I have RealSecure set to kill SYNFlood attacks via rskill (which are
tagged). At what phase of the connection attempt does this happen? The
reason I ask is that we recently had a SYNFlood attack on our mail server.
It was comprised of two attacks a minute apart from different IPs. One hit
port 25 while the other hit port 110. The server had to be rebooted prior
to SMTP functioning again. I am concerned that rskill may have been the
problem either directly or because it did not kill the attacks soon enough?
Verne Baxter
Sierra Tel Internet
[EMAIL PROTECTED]
