Good Morning, Rick... I have noticed a big increase in the number of DoS attacks on our mail server...Time, Event, Intruder, Count, Destination Port, Source Port 10-04-07 7:10:51 AM, Email_Mailman_Date_DoS, pD9E67014.dip.t-dialin.net, 1, 25, 3731, and it is a malformed header,([Denial of Service] This signature detects an email that contains a 'Date:' or 'X-List-Received-Date:' header that contains a malformed date.) and they are mostly coming out of Europe and China (go figure). I use a secondary ISS firewall on our server mostly for monitoring port probes. Otherwise, you may not see these attacks. Because of the timing you mentioned, and the timing of the increased attacks I am seeing, I thought there may be a correlation. We are running Imail 8.05 and Declude 4.3.46. The service stopping could be related to a filter that you have turned on that we have not, which wouldn't be good in any case because that means we are letting the Dos through, and you are are filtering it, but it is stopping your service...
Jon Lucas Poly-cast, Inc. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Rick Hogue Sent: Thursday, October 04, 2007 12:59 AM To: [email protected] Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason Yes the service stops. The event viewer states that DecludeProc stopped unexpectedly and has done this 1 time and that the service will be restarted. I am currently using version 4.3 Most times it will restart but if it stops like this two or three times in a 30 to 40 minute range then it hangs and will not restart without at least one reboot. Rick Hogue "I love woodworking!" What is your hobby? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John T (lists) Sent: Thursday, October 04, 2007 3:25 AM To: [email protected] Subject: RE: [Declude.JunkMail] Decludeproc stops for no reason Since Hobbies are something we do when we have the time, my hobby is sleeping. ;-)> Oh, sorry, your question. When this happens, is the service actually stopped? (Is decludeproc listed in Task Manager?) When you try to restart it, what error is displayed or logged in the Windows Event log? What version of Declude? John T > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Rick Hogue > Sent: Wednesday, October 03, 2007 11:25 PM > To: [email protected] > Subject: [Declude.JunkMail] Decludeproc stops for no reason > > Over the past 3 days I have had to reboot one of our mail servers at > least 6 > times due to the decludeproc stopping for no reason and not > restarting. We run 8.21 Imail with declude and sniffer but I keep getting these stops. This > was happening about once per week for a while and then it stopped but > now it > seems to be doing it daily. Any help on this would be appreciated. > > > Rick Hogue > "I love woodworking!" What is your hobby? > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
