Introduction
This document describes what does "SBRS rfc1918" on the mail logs or message tracking mean on the Cisco Email Security Appliance (ESA) / Cloud Email Security (CES).
What does "SBRS rfc1918" in the Mail Logs or Message Tracking Mean?
"SBRS rfc1918" is logged due to the connecting mail server to the ESA/CES is coming from a private IP and not a internet routable IP.
According to RFC 1918, private internet addresses are:
10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)
Cisco ESA/CES does not query for SBRS scores for these addresses and instead log "rfc1918" on the SBRS score field.
An example of the SBRS field on private addresses:
Mon Sep 11 12:15:29 2006 Info: ICID 4 RELAY SG RELAYLIST match 192.168.50.7 SBRS rfc1918
Wed Sep 13 10:37:06 2006 Info: ICID 5 RELAY SG RELAYLIST match 192.10.66.71.110 SBRS rfc1918
Wed Sep 13 10:37:56 2006 Info: ICID 6 RELAY SG RELAYLIST match 172.16.1.2 SBRS rfc1918
An example of the SBRS field on internet routable addresses:
Mon Sep 11 11:58:29 2006 Info: ICID 3 ACCEPT SG UNKNOWNLIST match sbrs[-1.0:10.0] SBRS 5.2 country United States
Related Information
Feedback