http://www.eventid.net/display.asp?eventid=7010 <http://www.eventid.net/display.asp?eventid=7010&eventno=3923&source=MSExcha ngeTransport&phase=1> &eventno=3923&source=MSExchangeTransport&phase=1 regards simon whale _____ From: exchangelist-bounce@xxxxxxxxxxxxx [mailto:exchangelist-bounce@xxxxxxxxxxxxx] On Behalf Of Jensen, Douglas Sent: 24 May 2006 22:21 To: exchangelist@xxxxxxxxxxxxx Subject: [ExchangeList] Event ID 7010 I get event id 7010 similar to the following Event Type: Error Event Source: MSExchangeTransport Event Category: SMTP Protocol Event ID: 7010 Date: 1/13/2004 Time: 5:43:49 PM User: N/A Computer: COMPUTERNAME Description: This is an SMTP protocol log for virtual server ID 1, connection #30. The client at "18.104.22.168" sent a "xexch50" command, and the SMTP server responded with "504 Need to authenticate first ". The full command sent was "xexch50 1092 2". This will probably cause the connection to fail. I know that this was discussed about a month ago and I searched the archive but could not find a resolution. I have an exchange 2003 server on Windows 2003 server. I am sending mail to another exchange server. This other exchange server is not in my domain and we do not share a forest or anything else. There should be no authentication that takes place. I found on Microsoft some mention that the "xexch50 1092 2" tells the other server the size of some file that is coming. Maybe the size of the email being transported. The other server is supposed to respond with a BLOB (binary large object?) but that might have failed between the servers. Could be the ISA server firewall might have blocked it. I looked in my ISA server and found Event ID 15105 ISA server detected an all port scan attack from IP .... and this IP address is the same address as the exchange server I am trying to send the email messages to. Could ISA be confusing the blob and a port scan attack? That doesn't make since but I am not finding a Event ID 20031 unknown smtp command error in ISA that Microsoft says should be there if this is the problem. Did anyone resolve this issue already? I did the reg hack that was supposed to turn off the xexch50 on my end and set the SMTP server to say helo rather then ehlo so I would not advertise the xexch50 service on my end but the email is still sitting there in the outbound queue and not going anywhere. The message in the exchange server manager for the Queue just says "The connection was dropped by the remote host". Douglas Jensen <mailto:Douglas.Jensen@xxxxxxxxxxxxx> Douglas.Jensen@xxxxxxxxxxxxx Voice (952) 402-9821 Fax (952) 402-9815 Network Administrator Scott Carver Dakota CAP Agency, Inc. 712 Canterbury Road Shakopee, MN 55379 <file:///C:\Documents%20and%20Settings\djensen.SCDCAP\Application%20Data\Mic rosoft\Signatures\www.capagency.org> www.capagency.org These events indicate that the XEXCH50 protocol sink fired, but the exchange of the blobs failed between the servers listed in the events.