Re: [exim] 421 Too many concurrent SMTP connections; please…

Top Page
Delete this message
Reply to this message
Author: W B Hacker
Date:  
To: exim users
Subject: Re: [exim] 421 Too many concurrent SMTP connections; please tryagain later.
Paul Mwiu wrote:
> Jean-Paul,
>
> You can also try to increase your smtp_accept_max option if your are not
> been hit by spammers e.g
> smtp_accept_max = 50000
>
> regards
>
> Paul Mwiu


Unless one is running some humongous hardware direct on a fat fiber pipe, AND
NOT using significant DB calls, table lookups, or scanning, that figure is
probably very much NOT what you want to do.

Better to ID the source of the problem - which should be fairly obvious - and
quickly so if log_selector = + all and the Mark One human eyeball are applied
expeditiously.

Ex: We once had two separate botnets form the (erroneous) opinion that one of
our servers was an open-relay, and proceed to try to overwhelm each other with
their payloads.

Temporarily locally blacklisting the entire networks they had compromised (a
University in Korea and an ISP in Taiwan, IIRC), then switching to being more
up-front about what we were actually going to do with the garbage they offered -

eg drop them immediately at 'CONNECT' instead of blackholing after 'DATA',

... put paid to future repetition from others of the same tribe.

HTH,

Bill Hacker

>
> -----Original Message-----
> From: exim-users-bounces@??? [mailto:exim-users-bounces@exim.org] On
> Behalf Of Frank Heydlauf
> Sent: Wednesday, March 31, 2010 5:52 PM
> To: exim-users@???
> Subject: Re: [exim] 421 Too many concurrent SMTP connections; please try
> again later.
>
> On Wed, Mar 31, 2010 at 03:34:32PM +0100, Roger Burton West wrote:
>> On Wed, Mar 31, 2010 at 10:17:35AM -0400, Jean-Paul natola wrote:
>>> I'm hopin someone can help out here , people have been complaining over
> the last week that they cant send us email this is what they are recieng
>>> 421 Too many concurrent SMTP connections; please try again later.
>>> I'm getting TONS of these bounces,
>>> and these are users that have always sent to us
>> Check the logs. Are you being hit by a high-volume spammer?
>
> ... and (if shouldn't have yet) add "+smtp_connection" to
> log_selector in your config to monitor the connection count.
>