RE: [FW1] log: mail vs smtp

["Goetz, Jarrett" <JGoetz@FW1-NOSPAMJenzabar.net>]

Title: RE: [FW1] log: mail vs smtp

First thing I would do is check your 'SERVICES' file on your OS (Unix, NT, etc.) and it may possibly be in there.  If you want it to show up in the log viewer as its respective CheckPoint service or simply the service/port number if no CP service object exists, then comment out the line in question (i.e. "mail") in the SERVICES file.  (You may need to reboot your NT based management station for this to take affect, never tried otherwise.)

Rule 0 is characteristically stuff that is not listed in the rulebase yet warrants a log entry.  It is usually 1) anti-spoofing alerts; 2) SYNdefender giving some info; 3) SecuRemote Authentication; 4) Things dropped with that 'unknown established TCP packet' feature/issue; 5) IP options drops; 6) other auth failures...  Anyone else, what I am forgetting, I think there may be 1 more thing?

Hope that helps...

Jarrett

-----Original Message-----
From: Kolarík Michal [mailto:michal.kolarik@pragodata.cz]
Sent: Tuesday, June 05, 2001 06:03
To: 'fw-1-mailinglist@beethoven.us.checkpoint.com'
Subject: [FW1] log: mail vs smtp

helo everyone,
can somebody explain me diference between sevices : mail X smtp?
In my logs i have rejects for mail service and accept for smtp service.
But in Security Policy editor there is no such service as mail, only smtp.
And I have one more question what exactly mean rule 0? I think that it is
Properties & antispoofing.
Am I right?
Thanks for any answers.
      
                Michal

================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================