On Thu, 11 Aug 2022 at 00:51, Viktor Dukhovni via Exim-users <
exim-users@???> wrote:
>
> Can you post a "tshark" decode of a full capture of a failed delivery?
>
> # tcpdump -s0 -w /some/file.pcap ...
> # tshark -nr /some/file
>
> [ Keep the PCAP file, more questions may arise once the basic decode is
> posted. ]
>
>
I have a full capture run through tshark as per above at the following URL:
https://www.chromosphere.co.uk/wp-content/blogs.dir/1/files/2022/08/tshark_gmail.txt
(NB: I added a capture filter to tcpdump of the form: "port 25 || port 587
|| port 465 || port 2525" to filter down to SMTP traffic - if I need to
repeat using an alternate packet filter, please let me know - it's fairly
easy for me to do). Note that this was for an ~5.6MB attachment - the
initial delivery was via ipv6 which failed, and it then flicked back to v4
and worked. However, I have seen failures on both ipv6 and ipv4 prior to
implementing the workaround).
Graeme
