On 17/02/2022 05:01, Christian Balzer via Exim-users wrote: > If found it excruciatingly hard to correlate tcpdump and nf_conntrack
> flows, but those ICMP6 destination unreachable packets are the result of
> the local iptables rejecting a connection to port 43922 (the originating
> outbound SMTP session from here), something it allowed for the first 2
> seconds just fine.
I agree; I was just interested in the content of the ICMP
"destination unreachable" packets - they usually carry the
start of the cause packet as data. You might prefer to use
wireshark to poke around in the capture sample you showed.
