What Does "SBRS rfc1918" in the Mail Logs or Message Tracking Mean?

Available Languages

Download Options

  • PDF     (20.2 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (84.5 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (70.4 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:March 9, 2020
Document ID:214631

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes what does "SBRS rfc1918" on the mail logs or message tracking mean on the Cisco Email Security Appliance (ESA) / Cloud Email Security (CES).

    What does "SBRS rfc1918" in the Mail Logs or Message Tracking Mean?

    "SBRS rfc1918" is logged due to the connecting mail server to the ESA/CES is coming from a private IP and not a internet routable IP.

    According to RFC 1918, private internet addresses are:

    10.0.0.0 - 10.255.255.255 (10/8 prefix)
    172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
    192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

    Cisco ESA/CES does not query for SBRS scores for these addresses and instead log "rfc1918" on the SBRS score field.

    An example of the SBRS field on private addresses:

    Mon Sep 11 12:15:29 2006 Info: ICID 4 RELAY SG RELAYLIST match 192.168.50.7 SBRS rfc1918
    Wed Sep 13 10:37:06 2006 Info: ICID 5 RELAY SG RELAYLIST match 192.10.66.71.110 SBRS rfc1918
    Wed Sep 13 10:37:56 2006 Info: ICID 6 RELAY SG RELAYLIST match 172.16.1.2 SBRS rfc1918

    An example of the SBRS field on internet routable addresses:

    Mon Sep 11 11:58:29 2006 Info: ICID 3 ACCEPT SG UNKNOWNLIST match sbrs[-1.0:10.0] SBRS 5.2 country United States

    Related Information

    Revision History

    Revision Publish Date Comments
    1.0
    16-Jul-2019
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Jai Gill
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco