mirror of
https://github.com/zeek/zeek.git
synced 2025-10-14 20:48:21 +00:00
b8dc6ad120
An invalid mail transaction is determined as
* RCPT TO command without a preceding MAIL FROM
* a DATA command without a preceding RCPT TO
and logged as a weird.
The testing pcap for invalid mail transactions was produced with a Python
script against a local exim4 configured to accept more errors and unknown
commands than 3 by default:
# exim4.conf.template
smtp_max_synprot_errors = 100
smtp_max_unknown_commands = 100
See also: https://www.rfc-editor.org/rfc/rfc5321#section-3.3
|
||
|---|---|---|
| .. | ||
| files | ||
| frameworks | ||
| misc | ||
| packet-protocols | ||
| protocols | ||
| utils | ||
| init-bare.zeek | ||
| init-default.zeek | ||
| init-frameworks-and-bifs.zeek | ||
| init-supervisor.zeek | ||