Cisco Cisco Content Security Management Appliance M160 Guia Do Utilizador
3-11
Cisco IronPort AsyncOS 7.2.0 for Security Management User Guide
OL-21768-01
Chapter 3 Using Centralized Email Reporting
Incoming Mail Details
The interactive table at the bottom of the Incoming Mail page lists the top senders
that have connected to public listeners of the Email Security appliances. The table
shows domains, IP addresses, or network owners, based on the view selected.
Click the column headings to sort the data.
that have connected to public listeners of the Email Security appliances. The table
shows domains, IP addresses, or network owners, based on the view selected.
Click the column headings to sort the data.
The system acquires and verifies the validity of the remote host’s IP address by
performing a double DNS lookup. For more information about double DNS
lookups and sender verification, see the Cisco IronPort AsyncOS for Email User
Guide.
performing a double DNS lookup. For more information about double DNS
lookups and sender verification, see the Cisco IronPort AsyncOS for Email User
Guide.
The Incoming Mail Details listing has two views: Summary and All.
The Summary view shows the total number of attempted messages for each
sender, and includes a breakdown by category (the same categories as the
Incoming Mail Summary graph on the Overview page: number of clean messages,
stopped by reputation filtering, invalid recipients, spam detected, virus detected,
and stopped by content filter).
sender, and includes a breakdown by category (the same categories as the
Incoming Mail Summary graph on the Overview page: number of clean messages,
stopped by reputation filtering, invalid recipients, spam detected, virus detected,
and stopped by content filter).
The value for Stopped by Reputation Filtering is calculated based on several
factors:
factors:
•
Number of “throttled” messages from this sender
•
Number of rejected or TCP refused connections (may be a partial count)
•
A conservative multiplier for the number of messages per connection
When the appliance is under heavy load, an exact count of rejected connections is
not maintained on a per-sender basis. Instead, rejected connections counts are
maintained only for the most significant senders in each time interval. In this
situation, the value shown can be interpreted as a “floor”; that is, at least this many
messages were stopped.
not maintained on a per-sender basis. Instead, rejected connections counts are
maintained only for the most significant senders in each time interval. In this
situation, the value shown can be interpreted as a “floor”; that is, at least this many
messages were stopped.
Note
The Stopped by Reputation Filtering total on the Overview page is always based
on a complete count of all rejected connections. Only the per-sender connection
counts are limited due to load.
on a complete count of all rejected connections. Only the per-sender connection
counts are limited due to load.
The All view shows the connection information (Accepted and Rejected) for
senders, as well as the breakdown by category. An additional column, Stopped by
Recipient Throttling, lists messages that were not delivered because of throttling.
senders, as well as the breakdown by category. An additional column, Stopped by
Recipient Throttling, lists messages that were not delivered because of throttling.