Hello!
After we installed qmail some of our customers experienced problems sending certain kind of mails to our qmail server: mails generated from a PHP process (outside our company) and relayed through an exchange server (5.5 SP 2 under windows NT 4 SP5, also outside our company) couldnt make it to our qmail server. From their side, the connection was being reset during the DATA cmd:
499 Host unreachable: bcr.com.ar. Message subject: """". Rescheduling delivery for later.
After doing crazy things like using a packet sniffer to diagnose this problem, i've found this packet:
12:59:31.290903 xxx.xx.x.x.25 > xxx.xx.xx.xxx.3419:
P [tcp sum ok] 129:178(49) ack 1576 win 8760 (DF) (ttl 64, id 25151, len 89)
0x0000 4500 0059 623f 4000 4006 52ab ac10 0005 E..Yb?@[email protected].....
0x0010 c82f 1170 0019 0d5b b547 6004 0375 2232 ./.p...[.G`..u"2
0x0020 5018 2238 9ed1 0000 3435 3120 5365 6520 P."8....451.See.
0x0030 6874 7470 3a2f 2f70 6f62 6f78 2e63 6f6d http://pobox.com
0x0040 2f7e 646a 622f 646f 6373 2f73 6d74 706c /~djb/docs/smtpl
0x0050 662e 6874 6d6c 2e0d 0a f.html...
The problem was that the email had LFs without the CRs. The reason was clear now... but:
12:59:31.291069 xxx.xx.x.x.25 > xxx.xx.xx.xxx.3419:
R [tcp sum ok] 178:178(0) ack 1576 win 8760 (DF) (ttl 64, id 25152, len 40)
0x0000 4500 0028 6240 4000 4006 52db ac10 0005 E..(b@@[email protected].....
0x0010 c82f 1170 0019 0d5b b547 6035 0375 2232 ./.p...[.G`5.u"2
0x0020 5014 2238 bf4b 0000 P."8.K..
Instead of sending a FIN, the connection closed using RST (i believe it's because the originating process died), for some reason exchange couldnt see it and continued to send packets until his buffer was emptied, then he ignored the 451 and showed the 499 (aka connection reset by peer). Before getting flamed, i know that it's exchange's fault to ignore the 451, but, shouldnt the connection be closed by FIN instead of RST?
--
Maximiliano A. Kolus
Network Administrator
<[EMAIL PROTECTED]>
Bolsa De Comercio Rosario - Argentina
+54 341 4213471 / 78 ext 2291
