On Tue, 13 Aug 2002, Jeremy C. Reed wrote:
> The logged message "SMTP data timeout (message abandoned) on connection
> from" is unclear.
Okay, I did some debugging.
On a busy server, it is hard to read the -d11 output, because it appears
that different daemons (and different connections) all seem to have their
debugging information mixed together. (I looked in spec to see how I could
get each line to add a PID or other unique identifier, but I couldn't find
it. Any ideas?)
I did see a few:
SMTP>> 421 mail.foo SMTP incoming data timeout - closing connection.
By the way, my debug logs had a few lines like:
**** debug string overflowed buffer ****
Here's some tcpdump logging:
19:47:14.513738 12.155.196.46.28206 > 209.45.208.4.smtp: P [tcp sum ok]
74:80(6) ack 230 win 1915 (DF) (ttl 126, id 32540, len 46)
0x0000 4500 002e 7f1c 4000 7e06 0bb2 0c9b c42e E.....@.~.......
0x0010 d12d d004 6e2e 0019 0284 1047 9898 59ed .-..n......G..Y.
0x0020 5018 077b 1d2b 0000 4441 5441 0d0a P..{.+..DATA..
19:47:14.513738 209.45.208.4.smtp > 12.155.196.46.28206: . [tcp sum ok]
230:230(0) ack 80 win 5840 (DF) (ttl 64, id 38530, len 40)
0x0000 4500 0028 9682 4000 4006 3252 d12d d004 E..(..@.@.2R.-..
0x0010 0c9b c42e 0019 6e2e 9898 59ed 0284 104d ......n...Y....M
0x0020 5010 16d0 b36a 0000
19:47:14.513738 209.45.208.4.smtp > 12.155.196.46.28206: P 230:286(56) ack
80 win 5840 (DF) (ttl 64, id 38531, len 96)
0x0000 4500 0060 9683 4000 4006 3219 d12d d004 E..`..@.@.2..-..
0x0010 0c9b c42e 0019 6e2e 9898 59ed 0284 104d ......n...Y....M
0x0020 5018 16d0 24ba 0000 3335 3420 456e 7465 P...$...354.Ente
0x0030 7220 6d65 7373 6167 652c 2065 6e64 696e r.message,.endin
0x0040 6720 7769 7468 2022 2e22 206f 6e20 6120 g.with.".".on.a.
0x0050 6c69
I am not sure why this is repeated:
19:47:14.753738 209.45.208.4.smtp > 12.155.196.46.28206: P 230:286(56) ack
80 win 5840 (DF) (ttl 64, id 38532, len 96)
0x0000 4500 0060 9684 4000 4006 3218 d12d d004 E..`..@.@.2..-..
0x0010 0c9b c42e 0019 6e2e 9898 59ed 0284 104d ......n...Y....M
0x0020 5018 16d0 24ba 0000 3335 3420 456e 7465 P...$...354.Ente
0x0030 7220 6d65 7373 6167 652c 2065 6e64 696e r.message,.endin
0x0040 6720 7769 7468 2022 2e22 206f 6e20 6120 g.with.".".on.a.
0x0050 6c69
19:47:14.803738 12.155.196.46.28206 > 209.45.208.4.smtp: . [tcp sum ok]
5920:5920(0) ack 286 win 1859 (DF) (ttl 126, id 33820, len 40)
0x0000 4500 0028 841c 4000 7e06 06b8 0c9b c42e E..(..@.~.......
0x0010 d12d d004 6e2e 0019 0284 271d 9898 5a25 .-..n.....'...Z%
0x0020 5010 0743 abef 0000 0000 0000 0000 P..C..........
Then I don't see anything else for that connection.
Another example:
19:49:46.413738 209.45.208.4.smtp > 12.155.196.46.28208: P 230:286(56) ack
80 win 5840 (DF) (ttl 64, id 6390, len 96)
0x0000 4500 0060 18f6 4000 4006 afa6 d12d d004 E..`..@.@....-..
0x0010 0c9b c42e 0019 6e30 a235 1360 0286 5fc4 ......n0.5.`.._.
0x0020 5018 16d0 122f 0000 3335 3420 456e 7465 P..../..354.Ente
0x0030 7220 6d65 7373 6167 652c 2065 6e64 696e r.message,.endin
0x0040 6720 7769 7468 2022 2e22 206f 6e20 6120 g.with.".".on.a.
0x0050 6c69 li
19:49:46.463738 12.155.196.46.28208 > 209.45.208.4.smtp: . [tcp sum ok]
5920:5920(0) ack 286 win 1859 (DF) (ttl 126, id 39964, len 40)
0x0000 4500 0028 9c1c 4000 7e06 eeb7 0c9b c42e E..(..@.~.......
0x0010 d12d d004 6e30 0019 0286 7694 a235 1398 .-..n0....v..5..
0x0020 5010 0743 9964 0000 0000 0000 0000 P..C.d........
Then (if port 28208 means the same), it closes:
20:12:24.203738 209.45.208.4.smtp > 12.155.196.46.28208: FP
2721387416:2721387489(73) ack 42360772 win 5840 (DF) (ttl 64, id 6400, len
113)
0x0000 4500 0071 1900 4000 4006 af8b d12d d004 E..q..@.@....-..
0x0010 0c9b c42e 0019 6e30 a235 1398 0286 5fc4 ......n0.5...._.
0x0020 5019 16d0 b7bb 0000 3432 3120 6d61 696c P.......421.mail
0x0030 2e6f 6373 6f6e 6c69 6e65 2e63 6f6d 2053 .ocsonline.com.S
0x0040 4d54 5020 696e 636f 6d69 6e67 2064 6174 MTP.incoming.dat
0x0050 6120
(I don't see any corresponding log entry though.)
I've been told that this is ADSL and Outlook Express clients under some
Windows.
Any suggestions, on how I can troubleshoot this further?
Thanks,
Jeremy C. Reed
http://bsd.reedmedia.net/ -- BSD news and resources
http://www.isp-faq.com/ -- find answers to your questions
