This article applies to:

• Trustwave MailMarshal (SEG)

Symptoms:

Event ID: 3506
Type: Error
Source: MMReceiver
Description: Possible SMTP attack

Causes:

A connecting host has sent numerous unexpected SMTP commands.

If a connecting host issues many unexpected SMTP commands, it could be misconfigured, or it could be sending nonsensical commands repeatedly in an attempt to occupy connections or MailMarshal Receiver threads (a Denial of Service attack).

Generally "unexpected" commands in this context are repeated HELO, AUTH, HELP, RSET, NOOP, or VRFY commands.

Note: MailMarshal always replies to VRFY with "252 user appears to be valid". Outside applications cannot harvest address information using this command.

Actions:

This message is informational. If you see this message only occasionally, no action is required.

You may find that this message is logged repeatedly for a particular connecting host. If you are not receiving useful email from that host, you can choose to reject all connections from the host address. Use the Server and Array Properties > Blocked Hosts tab in the MailMarshal Configurator or Management Console.

Notes:

• Before blocking a host, be sure that you do not receive valid email from it. Some email server software uses repeated SMTP commands, particularly the RSET command.
• This message is not related to the MailMarshal DoS Attack Prevention feature. DoS Attack Prevention is triggered by excessive connection requests (not unexpected commands within a connection).