Traffic from port 25 to high ports?

From: Matt Simonsen (
Date: 09/27/01

Message-ID: <>
Date: Thu, 27 Sep 2001 09:22:24 -0700
From: Matt Simonsen <>
Subject: Traffic from port 25 to high ports?

I am seeing traffic regularly coming from remote servers' port 25
destined to our servers' high ports, generally in the 1-3k range. Is
this normal? I plan to block it all, from what I understand SMTP goes
only from 25 to 25, but if that's the case I can't figure out what this
would be.

According to our IPFilter logs the traffic generally has -AFP set,
please let me know off-line if a tidbit of info I could provide can help
you answer my question.

Matt Simonsen