Okay, I've had some good ideas and thing to check. In the meantime, I've
had a chance to run tcpdump on port 25 while an aol e-mail was being
bounced.
Here's the relevant part of the capture:
11:42:56.537510 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: P
1:100(99) ack 1 win 32768 <nop,nop,timestamp 393177179 2399415552>
0000: 4500 0097 a2a8 0000 2d06 8c01 400c 8ace E..."([EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 37f8 63f7 61fb XC;....{y7xcwa{
0020: 8018 8000 2a23 0000 0101 080a 176f 685b ....*#.......oh[
0030: 8f04 2d00 3232 3020 696d 6f2d 6d31 362e ..-.220 imo-m16.
0040: 6d78 2e61 6f6c 2e63 6f6d 2045 534d 5450 mx.aol.com ESMTP
0050: 2053 656e 646d 6169 6c20 382e 382e 382f Sendmail 8.8.8/
0060: 382e 382e 382f 414f 4c2d 352e 302e 303b 8.8.8/AOL-5.0.0;
0070: 2046 7269 2c20 3720 4170 7220 3230 3036 Fri, 7 Apr 2006
0080: 2031 333a 3432 3a35 3620 2d30 3430 3020 13:42:56 -0400
0090: 2845 4454 290d 0a (EDT)..
11:42:56.538391 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: P
1:20(19) ack 1 win 17520 (DF)
0000: 4500 003b 293a 4000 4006 b2cb d843 bb99 E..;):@[EMAIL PROTECTED];.
0010: 400c 8ace 0019 fad4 05ae 3412 7b73 0899 @..N..zT..4.{s..
0020: 5018 4470 1ecf 0000 3232 3020 736d 7470 P.Dp.O..220 smtp
0030: 2e70 6173 7374 6872 750d 0a .passthru..
11:42:56.653852 heinlein.openvistas.net.smtp > 61.129.32.115.13115: P 76:77(1)
ack 29 win 17376 <nop,nop,timestamp 1521950594 1233076377> (DF)
0000: 4500 0035 56ae 4000 4006 f243 d843 bb99 [EMAIL PROTECTED]@.rCXC;.
0010: 3d81 2073 0019 333b 0904 7242 caeb 8484 =. s..3;..rBJk..
0020: 8018 43e0 cba5 0000 0101 080a 5ab7 1f82 ..C`K%......Z7..
0030: 497f 4099 73 [EMAIL PROTECTED]
11:42:56.666606 imo-m16.mx.aol.com.64212 > heinlein.openvistas.net.smtp: P
1:26(25) ack 20 win 32768
0000: 4500 0041 a2a9 0000 2d06 8c56 400c 8ace E..A")[EMAIL PROTECTED]
0010: d843 bb99 fad4 0019 7b73 0899 05ae 3425 XC;.zT..{s....4%
0020: 5018 8000 4867 0000 4845 4c4f 2069 6d6f P...Hg..HELO imo
0030: 2d6d 3136 2e6d 782e 616f 6c2e 636f 6d0d -m16.mx.aol.com.
0040: 0a .
11:42:56.667499 heinlein.openvistas.net.2047 > imo-m16.mx.aol.com.smtp: P
1:26(25) ack 100 win 16384 <nop,nop,timestamp 2399415553 393177179> (DF)
0000: 4500 004d 79a0 4000 4006 6253 d843 bb99 E..My @[EMAIL PROTECTED];.
0010: 400c 8ace 07ff 0019 63f7 61fb 7b79 385b @..N...cwa{{y8[
0020: 8018 4000 4a6e 0000 0101 080a 8f04 2d01 [EMAIL PROTECTED]
0030: 176f 685b 4845 4c4f 2069 6d6f 2d6d 3136 .oh[HELO imo-m16
0040: 2e6d 782e 616f 6c2e 636f 6d0d 0a .mx.aol.com..
11:42:56.772567 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: P
100:192(92) ack 26 win 32768 <nop,nop,timestamp 393177203 2399415553>
0000: 4500 0090 a2aa 0000 2d06 8c06 400c 8ace E..."[EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 385b 63f7 6214 XC;....{y8[cwb.
0020: 8018 8000 ab4e 0000 0101 080a 176f 6873 ....+N.......ohs
0030: 8f04 2d01 3235 3020 696d 6f2d 6d31 362e ..-.250 imo-m16.
0040: 6d78 2e61 6f6c 2e63 6f6d 2048 656c 6c6f mx.aol.com Hello
0050: 2068 6569 6e6c 6569 6e2e 6f70 656e 7669 heinlein.openvi
0060: 7374 6173 2e6e 6574 205b 3231 362e 3637 stas.net [216.67
0070: 2e31 3837 2e31 3533 5d2c 2070 6c65 6173 .187.153], pleas
0080: 6564 2074 6f20 6d65 6574 2079 6f75 0d0a ed to meet you..
11:42:56.773419 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: P
20:39(19) ack 26 win 17520 (DF)
0000: 4500 003b 688c 4000 4006 7379 d843 bb99 E..;[EMAIL PROTECTED]@.syXC;.
0010: 400c 8ace 0019 fad4 05ae 3425 7b73 08b2 @..N..zT..4%{s.2
0020: 5018 4470 1ea0 0000 3235 3020 736d 7470 P.Dp. ..250 smtp
0030: 2e70 6173 7374 6872 750d 0a .passthru..
11:42:56.882933 imo-m16.mx.aol.com.64212 > heinlein.openvistas.net.smtp: P
26:58(32) ack 39 win 32768
0000: 4500 0048 a2ab 0000 2d06 8c4d 400c 8ace E..H"[EMAIL PROTECTED]
0010: d843 bb99 fad4 0019 7b73 08b2 05ae 3438 XC;.zT..{s.2..48
0020: 5018 8000 a5f7 0000 4d41 494c 2046 726f P...%w..MAIL Fro
0030: 6d3a 3c4d 6164 6469 6573 6461 6440 616f m:<[EMAIL PROTECTED]
0040: 6c2e 636f 6d3e 0d0a l.com>..
11:42:56.883639 heinlein.openvistas.net.2047 > imo-m16.mx.aol.com.smtp: P
26:58(32) ack 192 win 16384 <nop,nop,timestamp 2399415553 393177203> (DF)
0000: 4500 0054 3937 4000 4006 a2b5 d843 bb99 [EMAIL PROTECTED]@."5XC;.
0010: 400c 8ace 07ff 0019 63f7 6214 7b79 38b7 @..N...cwb.{y87
0020: 8018 4000 a79d 0000 0101 080a 8f04 2d01 [EMAIL PROTECTED]'.........-.
0030: 176f 6873 4d41 494c 2046 726f 6d3a 3c4d .ohsMAIL From:<M
0040: 6164 6469 6573 6461 6440 616f 6c2e 636f [EMAIL PROTECTED]
0050: 6d3e 0d0a m>..
11:42:56.894883 61.129.32.115.13115 > heinlein.openvistas.net.smtp: . ack 77
win 12 <nop,nop,timestamp 1233077392 1521950594> (DF)
0000: 4500 0034 8409 4000 3006 d4e9 3d81 2073 [EMAIL PROTECTED] s
0010: d843 bb99 333b 0019 caeb 8484 0904 7243 XC;.3;..Jk....rC
0020: 8010 000c 7e8b 0000 0101 080a 497f 4490 ....~.......I.D.
0030: 5ab7 1f82 Z7..
11:42:56.986349 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: P
192:211(19) ack 58 win 32768 <nop,nop,timestamp 393177224 2399415553>
0000: 4500 0047 a2ac 0000 2d06 8c4d 400c 8ace E..G",[EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 38b7 63f7 6234 XC;....{y87cwb4
0020: 8018 8000 fea1 0000 0101 080a 176f 6888 ....~!.......oh.
0030: 8f04 2d01 3535 3020 4163 6365 7373 2064 ..-.550 Access d
0040: 656e 6965 640d 0a enied..
11:42:56.987074 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: P
39:58(19) ack 58 win 17520 (DF)
0000: 4500 003b 613b 4000 4006 7aca d843 bb99 E..;a;@[EMAIL PROTECTED];.
0010: 400c 8ace 0019 fad4 05ae 3438 7b73 08d2 @..N..zT..48{s.R
0020: 5018 4470 78a1 0000 3535 3020 4163 6365 P.Dpx!..550 Acce
0030: 7373 2064 656e 6965 640d 0a ss denied..
11:42:57.102134 imo-m16.mx.aol.com.64212 > heinlein.openvistas.net.smtp: P
58:64(6) ack 58 win 32768
0000: 4500 002e a2ad 0000 2d06 8c65 400c 8ace E..."[EMAIL PROTECTED]
0010: d843 bb99 fad4 0019 7b73 08d2 05ae 344b XC;.zT..{s.R..4K
0020: 5018 8000 702e 0000 5155 4954 0d0a P...p...QUIT..
11:42:57.103003 heinlein.openvistas.net.2047 > imo-m16.mx.aol.com.smtp: P
58:64(6) ack 211 win 16384 <nop,nop,timestamp 2399415554 393177224> (DF)
0000: 4500 003a 0d25 4000 4006 cee1 d843 bb99 E..:[EMAIL PROTECTED]@.NaXC;.
0010: 400c 8ace 07ff 0019 63f7 6234 7b79 38ca @..N...cwb4{y8J
0020: 8018 4000 71be 0000 0101 080a 8f04 2d02 [EMAIL PROTECTED]>........-.
0030: 176f 6888 5155 4954 0d0a .oh.QUIT..
11:42:57.218306 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: P
211:254(43) ack 64 win 32768 <nop,nop,timestamp 393177246 2399415554>
0000: 4500 005f a2ae 0000 2d06 8c33 400c 8ace E.._"[EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 38ca 63f7 623a XC;....{y8Jcwb:
0020: 8018 8000 9f01 0000 0101 080a 176f 689e .............oh.
0030: 8f04 2d02 3232 3120 696d 6f2d 6d31 362e ..-.221 imo-m16.
0040: 6d78 2e61 6f6c 2e63 6f6d 2063 6c6f 7369 mx.aol.com closi
0050: 6e67 2063 6f6e 6e65 6374 696f 6e0d 0a ng connection..
11:42:57.218750 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: F
254:254(0) ack 64 win 32768 <nop,nop,timestamp 393177246 2399415554>
0000: 4500 0034 a2af 0000 2d06 8c5d 400c 8ace E..4"/[EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 38f5 63f7 623a XC;....{y8ucwb:
0020: 8011 8000 d937 0000 0101 080a 176f 689e ....Y7.......oh.
0030: 8f04 2d02 ..-.
11:42:57.218890 heinlein.openvistas.net.2047 > imo-m16.mx.aol.com.smtp: . ack
255 win 16384 <nop,nop,timestamp 2399415554 393177246> (DF)
0000: 4500 0034 349a 4000 4006 a772 d843 bb99 [EMAIL PROTECTED]@.'rXC;.
0010: 400c 8ace 07ff 0019 63f7 623a 7b79 38f6 @..N...cwb:{y8v
0020: 8010 4000 1938 0000 0101 080a 8f04 2d02 [EMAIL PROTECTED]
0030: 176f 689e .oh.
11:42:57.219292 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: P
58:101(43) ack 64 win 17520 (DF)
0000: 4500 0053 490a 4000 4006 92e3 d843 bb99 [EMAIL PROTECTED]@..cXC;.
0010: 400c 8ace 0019 fad4 05ae 344b 7b73 08d8 @..N..zT..4K{s.X
0020: 5018 4470 1918 0000 3232 3120 696d 6f2d P.Dp....221 imo-
0030: 6d31 362e 6d78 2e61 6f6c 2e63 6f6d 2063 m16.mx.aol.com c
0040: 6c6f 7369 6e67 2063 6f6e 6e65 6374 696f losing connectio
0050: 6e0d 0a n..
11:42:57.219422 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: F
101:101(0) ack 64 win 17520 (DF)
0000: 4500 0028 050a 4000 4006 d70e d843 bb99 E..([EMAIL PROTECTED]@.W.XC;.
0010: 400c 8ace 0019 fad4 05ae 3476 7b73 08d8 @..N..zT..4v{s.X
0020: 5011 4470 534e 0000 P.DpSN..
11:42:57.219730 heinlein.openvistas.net.2047 > imo-m16.mx.aol.com.smtp: F
64:64(0) ack 255 win 16384 <nop,nop,timestamp 2399415554 393177246> (DF)
0000: 4500 0034 1b4c 4000 4006 c0c0 d843 bb99 [EMAIL PROTECTED]@.@@XC;.
0010: 400c 8ace 07ff 0019 63f7 623a 7b79 38f6 @..N...cwb:{y8v
0020: 8011 4000 1937 0000 0101 080a 8f04 2d02 [EMAIL PROTECTED]
0030: 176f 689e .oh.
11:42:57.323446 imo-m16.mx.aol.com.64212 > heinlein.openvistas.net.smtp: . ack
102 win 32768
0000: 4500 0028 a2b0 0000 2d06 8c68 400c 8ace E..("[EMAIL PROTECTED]
0010: d843 bb99 fad4 0019 7b73 08d8 05ae 3477 XC;.zT..{s.X..4w
0020: 5010 8000 17be 0000 0000 0000 0000 P....>........
11:42:57.323532 imo-m16.mx.aol.com.64212 > heinlein.openvistas.net.smtp: F
64:64(0) ack 102 win 0
0000: 4500 0028 a2b1 0000 2d06 8c67 400c 8ace E..("[EMAIL PROTECTED]
0010: d843 bb99 fad4 0019 7b73 08d8 05ae 3477 XC;.zT..{s.X..4w
0020: 5011 0000 97bd 0000 0000 0000 0000 P....=........
11:42:57.323641 heinlein.openvistas.net.smtp > imo-m16.mx.aol.com.64212: . ack
65 win 17519 (DF)
0000: 4500 0028 7ddc 4000 4006 5e3c d843 bb99 E..([EMAIL PROTECTED]@.^<XC;.
0010: 400c 8ace 0019 fad4 05ae 3477 7b73 08d9 @..N..zT..4w{s.Y
0020: 5010 446f 534e 0000 P.DoSN..
11:42:57.326222 imo-m16.mx.aol.com.smtp > heinlein.openvistas.net.2047: . ack
65 win 32768 <nop,nop,timestamp 393177258 2399415554>
0000: 4500 0034 a2b2 0000 2d06 8c5a 400c 8ace E..4"[EMAIL PROTECTED]
0010: d843 bb99 0019 07ff 7b79 38f6 63f7 623b XC;....{y8vcwb;
0020: 8010 8000 d92a 0000 0101 080a 176f 68aa ....Y*.......oh*
0030: 8f04 2d02 ..-.
The "220 smtp.passthru." line looks suspicious to me. Does this mean that
aol is trying to relay their mail through my server? That would explain
the 550 error.
In any case, this is clearly not related to spamd, so on to gmail!
Jeff
