Signature 3106 Sendmail Spam for IDS

[rcrowe]

I am running CSPM and a 4210 sensor which is located outside the firewall, watching all external traffic. Before I had Cisco Secure IDS I was using the IOS IDS on a 7200 and I could set a limit on the amount of recipients for SPAM. I do not see anyway to do this in CSPM ? It just has the regular: IPLog, Block, Reset. No input parameters.

[marcabal]

This feature is not configurable through CSPM, it uses a default of 250.

But CSPM version 2.3.1i has a new feature which allows you to configure items which are not configurable through the GUI.

Use the Epilogue feature to append the following line to packetd.conf (change 300 to the number of recipients you want):

NumberOfRcptTo 300

This will override the default of 250.

For instructions on using the Epilogue feature refer to:

http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch06.htm#969006

[rcrowe]

thnx