Can anyone describe this alert please?

enter image description here

I am confused if an attack is run against my network or not.

I run snort IDS/IPS through a pfsense firewall.

  • Can you provide more information? Like the payload of the packet? – bashCypher Jan 15 '19 at 0:44

It is most probably a false positive like mentioned here https://community.spiceworks.com/topic/1514894-snort-attempted-command-buffer-overflow-smtp

you should provide more details such as is the traffic originating interally or any other logs you have.

| improve this answer | |
  • How i can find more details , i just monitor the WAN interface – YOU CHT LEE Jan 14 '19 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.