Cisco Cisco Firepower Management Center 2000

Protection

The Post Office Protocol (POP) is used to retrieve email from a remote POP mail server. The POP 
preprocessor inspects server-to-client POP3 traffic and, when associated preprocessor rules are enabled, 
generates events on anomalous traffic. The preprocessor can also extract and decode email attachments 
in client-to-server POP3 traffic and send the attachment data to the rules engine. You can use the 

file_data

 keyword in an intrusion rule to point to attachment data. See 

 for more information.

Extraction and decoding include multiple attachments, when present, and large attachments that span 
multiple packets.

Note the following when using the POP preprocessor:

Because POP traffic is carried over TCP/IP connections, the POP preprocessor requires TCP stream 
preprocessing. If TCP stream preprocessing is disabled and you enable the POP preprocessor, you 
are prompted when you save the policy whether to enable TCP stream preprocessing. See 

 and 

 for more information.

If you want POP preprocessor rules to generate events, you must enable the rules. POP preprocessor 
rules have a generator ID (GID) of 142. A link on the configuration page takes you to a filtered view 
of POP preprocessor rules on the intrusion policy Rules page, where you can enable and disable 
rules and configure other rule actions. See 

 for more information.

See the following sections for more information:

Protection

The following list describes the POP preprocessor options you can modify.

Note that decoding, or extraction when the MIME email attachment does not require decoding, includes 
multiple attachments when present, and large attachments that span multiple packets.

Note also that when the values for the 

, 

, 

, or 

 options are different in an intrusion policy 

associated with the default action of an access control policy and intrusion policies associated with 
access control rules, the highest value is used. See 

, and 

 for more information.

If no preprocessor rule is mentioned, the option is not associated with a preprocessor rule.

Specifies the ports to inspect for POP traffic. You can specify an integer from 0 to 65535. Separate 
multiple port numbers with commas.