On Tue, 19 Feb 2002, Jochen Erwied wrote:
> a) When receiving messages from a Novell-Groupwise-System, sometimes one
> 'Received:'-line appears somewhere inside the body of the mail.
>
> It looks like only mails coming from this system are affected, no other
> mails have shown up with this behaviour. But I don't know how
> to reproduce it.
Please gather as much evidence as you can. Saving a copy of an offending
mail might be helpful, but it sounds as if this is something that is
going to be hard to track down. Is the rest of the mail's body OK?
> The mail contains an additional 'Received: from KPMX-MTA by
> mail.kieback-peter.de'. Nothing more, nothing less, exactly this
> single string.
With or without a terminating linefeed?
> b) The system logs lots of 'tcp_ack'-messages when receiving mails
> from an external source. This message is coming from the tcp-stack,
> but I'm not enough of a hacker to understand what is (or why)happening
> there.
Neither am I.
> Example (wrapped long lines):
>
> Feb 19 11:13:13 gate kernel: ^Mtcp_ack: seq a8c9e07c ack 5aafd932
> Feb 19 11:13:13 gate kernel:
> Data arrived on 053c8c0c after close
> [Data right edge 5AAFD955, Socket shut on 5AAFD933] 0
I don't know what these mean at all. Are there any experts who do on
this list? Well, I suppose "data arrived after close" is pretty obvious.
It looks as if the TCP/IP connection is getting scrambled, but I have no
idea how Exim could possibly influence things at that level.
Is it possible to correlate those messages with anything significant on
the Exim log? One possibly line of attack would be to turn on SMTP
connection logging and all the other optional SMTP logging, just in case
something on the log matches up.
--
Philip Hazel University of Cambridge Computing Service,
ph10@??? Cambridge, England. Phone: +44 1223 334714.
