Contents

Introduction

What does "SBRS rfc1918" in the Mail Logs or Message Tracking Mean?

Related Information

Introduction

This document describes what does "SBRS rfc1918" on the mail logs or message tracking mean on the Cisco Email Security Appliance (ESA) / Cloud Email Security (CES).

What does "SBRS rfc1918" in the Mail Logs or Message Tracking Mean?

"SBRS rfc1918" is logged due to the connecting mail server to the ESA/CES is coming from a private IP and not a internet routable IP.

According to RFC 1918, private internet addresses are:

10.0.0.0 - 10.255.255.255 (10/8 prefix)

172.16.0.0 - 172.31.255.255 (172.16/12 prefix)

192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

Cisco ESA/CES does not query for SBRS scores for these addresses and instead log "rfc1918" on the SBRS score field.

An example of the SBRS field on private addresses:

Mon Sep 11 12:15:29 2006 Info: ICID 4 RELAY SG RELAYLIST match 192.168.50.7 SBRS rfc1918

Wed Sep 13 10:37:06 2006 Info: ICID 5 RELAY SG RELAYLIST match 192.10.66.71.110 SBRS rfc1918

Wed Sep 13 10:37:56 2006 Info: ICID 6 RELAY SG RELAYLIST match 172.16.1.2 SBRS rfc1918

An example of the SBRS field on internet routable addresses:

Mon Sep 11 11:58:29 2006 Info: ICID 3 ACCEPT SG UNKNOWNLIST match sbrs[-1.0:10.0] SBRS 5.2 country United States

Related Information

- Cisco Email Security Appliance - End-User Guides

- Technical Support & Documentation - Cisco Systems

- RFC 1918 Document