Would I be able to get a general explanation of what is happening when the protocol log shows "Unidentified IP Traffic"?
Currently the lovely comcast blocking actions have forced me to accept incoming SMTP traffic on port 2525. Even though email is coming through and accepted (most of the time), I am still getting a fair number of entries listing 2525 as Unidentified IP Traffic. I will be ripping through this with a fine tooth comb on Thurs but I wanted to try and get my head set straight as to why this might be happening before I go unnecessarily bezerk with troubleshooting. The custom port is TCP 2525 inbound, using SMTP filter.
Any other info about my settings that would help paint the picture, please ask.
From: United Kingdom
Unidentified is normally only shown when an existing protocol cannot be matched. Sometimes this happens becuase a default ISA defined protocol uses TCP for example but an application also uses UDP. In this scenario, the UDP traffic will get identified as "unidentified".
A similar thing can happen when people incorrectly define traffic as inbound/outbound and get it the wrong way around...in general, inbound is only used for publishing rules and outbound is used for access rules (even if the traffic direction is inbound relative to ISA ).
< Message edited by Jason Jones -- 28.Oct.2009 10:59:41 AM >
From: United Kingdom
If you are using SMTP publishing for inbound mail, you would define a custom protocol like 'SMTP Server (TCP2525)', port = 2525, direction equals inbound, protocol equals TCP, no secondary connections.
If you are using access rules you define a custom protocol like 'SMTP (TCP2525)', port = 2525, direction equals outbound, protocol equals TCP, no secondary connections.
Thanks for the tip. I think the rule/protocol is configured as you indicated but I'm off site and the moment and will check later this afternoon.
Also, Is there way to capture the actual requests coming in so I can see what the difference is between blocked and non-blocked smtp requests? Maybe this is way to involved and time consuming than it's worth in the long run, but thought it would be an interesting.