Greetings,
I’m running 5.0.3 in IPS and only monitor source/dest port 25. Looking at eve it says drop
{“timestamp”:“2020-06-17T08:05:32.839965-0500”,“flow_id”:575006279918989,“event_type”:“drop”,“src_ip”:“93.177.102.176”,“src_port”:61048,“dest_ip”:“x.x.x.x”,“dest_port”:25,“proto”:“TCP”,“drop”:{“len”:52,“tos”:0,“ttl”:53,“ipid”:41502,“tcpseq”:3107473674,“tcpack”:1532258928,“tcpwin”:123,“syn”:false,“ack”:true,“psh”:false,“rst”:true,“urg”:false,“fin”:false,“tcpres”:0,“tcpurgp”:0}}
but yet the email still comes through (based on time stamp 08:05:32)?
Received: from ([127.0.0.1])
by [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id QSWBfFDhn1Yx for <>;
Wed, 17 Jun 2020 08:05:32 -0500 (CDT)
Received: from bananahorizon.icu (bananahorizon.icu [93.177.102.176])
by (Postfix) with ESMTP id 4935815A0007
for ; Wed, 17 Jun 2020 08:05:29 -0500 (CDT)
Here’s the only prior record between 07:56:20 and 08:05:32
{“timestamp”:“2020-06-17T07:56:20.000155-0500”,“flow_id”:242397530740470,“event_type”:“flow”,“src_ip”:“93.177.102.176”,“src_port”:62886,“dest_ip”:“x.x.x.x”,“dest_port”:25,“proto”:“TCP”,“flow”:{“pkts_toserver”:3,“pkts_toclient”:0,“bytes_toserver”:3052,“bytes_toclient”:0,“start”:“2020-06-17T07:55:18.251638-0500”,“end”:“2020-06-17T07:55:18.251962-0500”,“age”:0,“state”:“new”,“reason”:“timeout”,“alerted”:false},“tcp”:{“tcp_flags”:“00”,“tcp_flags_ts”:“00”,“tcp_flags_tc”:“00”}}
It seems to me suricata blocks partially or something wrong with my setup?
Thanks.