Forum Discussion
jhanington_1353
Nimbostratus
NimbostratusNeed help blocking SMTP connections based off EHLO name
I keep getting attacked from this stupid spam bot script kiddie.
The script is going to our SMTP server and is trying to guess a bunch of typical email addresses but it also somehow got a hold o...
Sorry, big oversight on my part. Try this one:
when CLIENT_ACCEPTED { TCP::respond "220\r\n" TCP::collect } when CLIENT_DATA { set clientpayload [string tolower[TCP::payload]] if { $clientpayload contains "ehlo abcd-pc" } { reject } }
Cory_50405
Noctilucent
NoctilucentSorry, big oversight on my part. Try this one:
when CLIENT_ACCEPTED {
TCP::respond "220\r\n"
TCP::collect
}
when CLIENT_DATA {
set clientpayload [string tolower[TCP::payload]]
if { $clientpayload contains "ehlo abcd-pc" } {
reject
}
}
Cory_50405Noctilucent
NoctilucentI think this should work.