topic Re: IPS \ Application Signature in General Topics

IPS \ Application Signature

along — Tue, 03 Jul 2012 06:41:27 GMT

Hi all

I need to write ips / application signature to recognize sender and recipient in SMTP

for example:

If smtp sender A send mail to recipent B - Allow.

If smtp sender A send mail to recipent C - Block

I will be happy if anyone know how to do it.

Alon

Re: IPS \ Application Signature

rmonvon — Tue, 03 Jul 2012 13:36:20 GMT

Hi...You can try to create a custom app to match the pattern using the context of 'smtp-req-argument'. More info can be found here:

Thanks,

Re: IPS \ Application Signature

mikand — Wed, 04 Jul 2012 06:01:55 GMT

By the way does the same options (well what you can trigger on such as "smtp-req-argument") exist in both custom app aswell as custom ips or are there differences?

Im thinking of when one should do a custom app instead off a custom ips signature?