[isalist] Re: SMTP Connection Closed
- From: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
- To: "isalist@xxxxxxxxxxxxx" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 18 Jan 2007 19:26:34 -0800
http://www.ISAserver.org
-------------------------------------------------------
Wouldn't be if you disabled the filter altogether. If you can telnet and
get a "blank line," that means that you have established a TCP connection,
but that something is keeping the application layer from communicating
properly. If you couldn't connect at all, you would get a "connection
failed" message. so, you are at least connecting and doing a 3 way
handshake - it's not mx or dns in that case. Can these hosts telnet to other
published services like HTTP?
But, what Jim originally suggested is the way to go- time for a capture.
t
On 1/18/07 7:02 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
> http://www.ISAserver.org
> -------------------------------------------------------
>
> 1024 - no good!
>
> Joseph Danielsen, MCSA-Messaging, MCP
>
> Network Blade Inc.
>
> 49 Marcy Street
>
> Somerset, NJ 08873
>
> 732-213-0600
>
> www.networkblade.com
>
>
>
>
>
>
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
> On Behalf Of Thomas W Shinder
> Posted At: Thursday, January 18, 2007 9:56 PM
> Posted To: ISA
> Conversation: [isalist] Re: SMTP Connection Closed
> Subject: [isalist] Re: SMTP Connection Closed
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> Change NOOP to 1024
>
> Thomas W Shinder, M.D.
> Site: www.isaserver.org
> Blog: http://blogs.isaserver.org/shinder/
> Book: http://tinyurl.com/3xqb7
> MVP -- Microsoft Firewalls (ISA)
>
>
>
>> -----Original Message-----
>> From: isalist-bounce@xxxxxxxxxxxxx
>> [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of ISA
>> Sent: Thursday, January 18, 2007 8:49 PM
>> To: isalist@xxxxxxxxxxxxx
>> Subject: [isalist] Re: SMTP Connection Closed
>>
>> http://www.ISAserver.org
>> -------------------------------------------------------
>>
>> Nope! The only thing I changed was the NOOP to 20 (per Thor's advise).
>> First time I ever messed around with the Proto filters. Exchange box:
>> Dell PE2800 2GB mem. ISA: Dell PE1430 1GB mem. Both doing nothing but
>> handling mail for 3 mail accounts.
>>
>> Joseph Danielsen, MCSA-Messaging, MCP
>>
>> -----Original Message-----
>> From: isalist-bounce@xxxxxxxxxxxxx
>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>> On Behalf Of Greg Mulholland
>> Posted At: Thursday, January 18, 2007 9:42 PM
>> Posted To: ISA
>> Conversation: [isalist] Re: SMTP Connection Closed
>> Subject: [isalist] Re: SMTP Connection Closed
>>
>> http://www.ISAserver.org
>> -------------------------------------------------------
>>
>> gotta be some sort of connect limit, i would have thought
>> noop as well.
>> Have
>> you customised any of your smtp rules or smtp filters beyond
>> the normal
>> setup? have you customised any of the settings exchange connection
>> limit
>> settings
>>
>> whats the hardware specs of the exchange box and isa box?
>>
>> how long do you wait for the before banner before closing the window?
>>
>>
>> Greg
>> ----- Original Message -----
>> From: "ISA" <ISA@xxxxxxxxxxxxxxxx>
>> To: <isalist@xxxxxxxxxxxxx>
>> Sent: Friday, January 19, 2007 1:29 PM
>> Subject: [isalist] SMTP Connection Closed
>>
>>
>> http://www.ISAserver.org
>> -------------------------------------------------------
>>
>>
>> Nothing at all -
>> I enter telnet mail.domain.com 25 (hit enter) the line disappears and
>> the curser just sits there and blinks - no banner - nothing. If I hit
>> enter again it goes back to the C:\ prompt.
>>
>> I tried the steps in that article mentioned earlier - but I can't get
>> passed the first step (mentioned above). However, I see the port 25
>> attempt on the ISA firewall logs - then is CLOSES after 5 seconds.
>>
>>
>> Joseph Danielsen, MCSA-Messaging, MCP
>>
>> Network Blade Inc.
>>
>> 49 Marcy Street
>>
>> Somerset, NJ 08873
>>
>> 732-213-0600
>>
>> www.networkblade.com
>>
>>
>>
>>
>>
>>
>> -----Original Message-----
>> From: isalist-bounce@xxxxxxxxxxxxx
>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>> On Behalf Of Thor (Hammer of God)
>> Posted At: Thursday, January 18, 2007 9:24 PM
>> Posted To: ISA
>> Conversation: [isalist] SMTP Connection Closed
>> Subject: [isalist] Re: SMTP Connection Closed
>>
>> http://www.ISAserver.org
>> -------------------------------------------------------
>>
>> What actually happens when the telnet session is initiated?
>> Do you see
>> anything? Any connect at all?
>>
>> t
>>
>>
>> On 1/18/07 6:10 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
>>
>>> http://www.ISAserver.org
>>> -------------------------------------------------------
>>>
>>> Thanks guys - I'll follow the article is see what goes -
>>>
>>> Did anyone have any problems actually connecting?
>>>
>>> I also thought of MTU issues. Two of the sites that can not connect;
>> one
>>> is fronted with a SonicWall, the other a Linksys (stop,
>> don't even say
>>> it... I know).
>>>
>>>
>>>
>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>
>>> -----Original Message-----
>>> From: isalist-bounce@xxxxxxxxxxxxx
>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>>> On Behalf Of Greg Mulholland
>>> Posted At: Thursday, January 18, 2007 8:58 PM
>>> Posted To: ISA
>>> Conversation: [isalist] Re: SMTP Connection Closed
>>> Subject: [isalist] Re: SMTP Connection Closed
>>>
>>> http://www.ISAserver.org
>>> -------------------------------------------------------
>>>
>>> I'm wondering if he is experiencing any other signs of
>> flaky internet
>>> connection. Like in browsing etc etc. Ive seen mtu issues do this.
>>>
>>> Greg
>>> ----- Original Message -----
>>> From: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
>>> To: <isalist@xxxxxxxxxxxxx>
>>> Sent: Friday, January 19, 2007 12:49 PM
>>> Subject: [isalist] Re: SMTP Connection Closed
>>>
>>>
>>>> http://www.ISAserver.org
>>>> -------------------------------------------------------
>>>>
>>>> But that wouldn't have anything at all to do with telnetting to 25,
>>> which
>>>> I
>>>> can do, but I now see that others cannot. A blacklist or etc will
>> not
>>>> affect that.
>>>>
>>>> t
>>>>
>>>>
>>>> On 1/18/07 4:29 PM, "Amy Babinchak"
>> <amy@xxxxxxxxxxxxxxxxxxxxxxxxxx>
>>>> spoketh
>>>> to all:
>>>>
>>>>> It only effects incoming email.
>>>>>
>>>>> You can get around it by using a smarthost. Your cable company
>>> probably
>>>>> allows
>>>>> you to use their server for such purpose. That's how I get around
>> it.
>>>>>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
>>>>> Sent: Thu 1/18/2007 7:22 PM
>>>>> To: isalist@xxxxxxxxxxxxx
>>>>> Subject: [isalist] SMTP Connection Closed
>>>>>
>>>>>
>>>>> I thought that would affect my outgoing mail - not incoming!
>>>>>
>>>>> <unfortunately I can't get a static IP for another few months, I
>> will
>>>
>>>>> then>
>>>>>
>>>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>>> Network Blade Inc.
>>>>> 49 Marcy Street
>>>>> Somerset, NJ 08873
>>>>> 732-213-0600
>>>>> www.networkblade.com <http://www.networkblade.com/>
>>>>>
>>>>>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/image001.jpg>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/image002.jpg>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx
>>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>>>>> On
>>>>> Behalf Of Amy Babinchak
>>>>> Sent: Thursday, January 18, 2007 7:20 PM
>>>>> To: isalist@xxxxxxxxxxxxx
>>>>> Subject: RE: [isalist] SMTP Connection Closed
>>>>>
>>>>> according to dsnstuff.com you are listed on 3 blacklists
>> and have no
>>>>> reverse
>>>>> DNS entry. That's enough right there to cause you to have
>>> inconsistant
>>>>> incoming email issues.
>>>>>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
>>>>> Sent: Thu 1/18/2007 7:06 PM
>>>>> To: isalist@xxxxxxxxxxxxx
>>>>> Subject: [isalist] SMTP Connection Closed
>>>>> Amy:
>>>>> DNS seems to be working (mail.networkblade.com resolves to the
>>> correct
>>>>> IP),
>>>>> "I" am not blacklisting and I don't know how to Grey list.
>>>>>
>>>>> The ISP (cable company) is always suspect of everything else.
>>>>>
>>>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>>> Network Blade Inc.
>>>>> 49 Marcy Street
>>>>> Somerset, NJ 08873
>>>>> 732-213-0600
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx
>>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>>>>> On
>>>>> Behalf Of Amy Babinchak
>>>>> Sent: Thursday, January 18, 2007 7:02 PM
>>>>> To: isalist@xxxxxxxxxxxxx
>>>>> Subject: RE: [isalist] SMTP Connection Closed
>>>>>
>>>>> So assuming that this used to work you've eliminated the other
>>> obvious
>>>>> things
>>>>> besides filtering like bad DNS, flakey ISP, blacklisting, grey
>>> listing,
>>>>> etc?
>>>>>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
>>>>> Sent: Thu 1/18/2007 6:46 PM
>>>>> To: isalist@xxxxxxxxxxxxx
>>>>> Subject: [isalist] SMTP Connection Closed
>>>>> Good questions!
>>>>> Thor: I was referring to Exchange filtering NOT ISA. I
>> was not aware
>>> of
>>>>> the
>>>>> NOOP config in the SMTP filter properties.
>>>>> Amy: By client I mean another account with a separate ISP and
>>> Exchange
>>>>> server
>>>>> somewhere else in the world. i.e. NJ.
>>>>>
>>>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>>> Network Blade Inc.
>>>>> 49 Marcy Street
>>>>> Somerset, NJ 08873
>>>>> 732-213-0600
>>>>> www.networkblade.com <http://www.networkblade.com/>
>>>>>
>>>>>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/%20>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/%20>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx
>>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>>>>> On
>>>>> Behalf Of Thor (Hammer of God)
>>>>> Posted At: Thursday, January 18, 2007 6:40 PM
>>>>> Posted To: ISA
>>>>> Conversation: [isalist] SMTP Connection Closed
>>>>> Subject: [isalist] Re: SMTP Connection Closed
>>>>>
>>>>> Just to make sure we're saying the same thing.. Not filtering via
>>>>> Exchange and
>>>>> 3rd party- the ISA SMTP filter. You disabled that?
>>>>>
>>>>> t
>>>>>
>>>>>
>>>>> On 1/18/07 3:30 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
>>>>> Thor - thanks but I've turned off ALL filtering via
>> Exchange and 3rd
>>>>> party
>>>>> software.
>>>>>
>>>>> I've tried connecting (via telnet) from multiple
>> locations (ISP) and
>>> from
>>>>> Exchange 2003 and SBS 2003. Some work and Some don't.
>> When watching
>>> the
>>>>> ISA
>>>>> real-time logs, the connection is initiated then 5
>> seconds later it
>>> is
>>>>> then
>>>>> closed by the Exchange publishing rule.
>>>>>
>>>>> A 12-pack for the one who gets this one!
>>>>>
>>>>> <and this is on my own server/network>
>>>>>
>>>>>
>>>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>>> Network Blade Inc.
>>>>> 49 Marcy Street
>>>>> Somerset, NJ 08873
>>>>> 732-213-0600
>>>>> www.networkblade.com <http://www.networkblade.com/>
>>>>> <http://www.networkblade.com/>
>>>>>
>>>>>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/%20>
>>>>>
>>>
>> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
>> t]%20SMTP%
>>> 20Conn
>>>>> ection%20Closed.EML/1_multipart/%20>
>>>>> ________________________________
>>>>>
>>>>> From: isalist-bounce@xxxxxxxxxxxxx
>>> [mailto:isalist-bounce@xxxxxxxxxxxxx]
>>>>> <mailto:isalist-bounce@xxxxxxxxxxxxx%5d> On Behalf Of
>> Thor (Hammer
>>> of
>>>>> God)
>>>>> Posted At: Thursday, January 18, 2007 6:22 PM
>>>>> Posted To: ISA
>>>>> Conversation: [isalist] SMTP Connection Closed
>>>>> Subject: [isalist] Re: SMTP Connection Closed
>>>>>
>>>>> Check your SMTP filter settings for command lengths...
>> NOOP has been
>>>>> problematic before at its default of 6 - I changed mine
>> to 20 after
>>>>> sniffing
>>>>> traffic and determining some older Exchange boxes were
>> padding NOOP
>>> with
>>>>> spaces..
>>>>>
>>>>> t
>>>>>
>>>>>
>>>>> On 1/18/07 1:46 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
>>>>> Hope someone can help!
>>>>>
>>>>> I think this is an ISA 2004 (patched) issue.
>>>>>
>>>>> From some clients I can send/receive email just fine (and telnet
>> port
>>>
>>>>> 25). But
>>>>> from other clients I can not. I monitored the ISA logs
>> and observed
>>> the
>>>>> connection initiated then being closed.
>>>>>
>>>>> From Exchange 2003 box I shut of IMF and GFI services - still not
>>> luck
>>>>> receiving email or telnet'ing from a particular client.
>>>>>
>>>>> Any ideas would be greatly appreciated.
>>>>>
>>>>> Respectfully
>>>>>
>>>>>
>>>>> Joseph Danielsen, MCSA-Messaging, MCP
>>>>> Network Blade Inc.
>>>>> 49 Marcy Street
>>>>> Somerset, NJ 0887
>>>>> 732-213-0600
>>>>>
>>>>
>>>>
>>>> ------------------------------------------------------
>>>> List Archives: //www.freelists.org/archives/isalist/
>>>> ISA Server Newsletter:
>> http://www.isaserver.org/pages/newsletter.asp
>>>> ISA Server Articles and Tutorials:
>>>> http://www.isaserver.org/articles_tutorials/
>>>> ISA Server Blogs: http://blogs.isaserver.org/
>>>> ------------------------------------------------------
>>>> Visit TechGenix.com for more information about our other sites:
>>>> http://www.techgenix.com
>>>> ------------------------------------------------------
>>>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>>>> Report abuse to listadmin@xxxxxxxxxxxxx
>>>>
>>>>
>>>
>>> ------------------------------------------------------
>>> List Archives: //www.freelists.org/archives/isalist/
>>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>>> ISA Server Articles and Tutorials:
>>> http://www.isaserver.org/articles_tutorials/
>>> ISA Server Blogs: http://blogs.isaserver.org/
>>> ------------------------------------------------------
>>> Visit TechGenix.com for more information about our other sites:
>>> http://www.techgenix.com
>>> ------------------------------------------------------
>>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>>> Report abuse to listadmin@xxxxxxxxxxxxx
>>>
>>> ------------------------------------------------------
>>> List Archives: //www.freelists.org/archives/isalist/
>>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>>> ISA Server Articles and Tutorials:
>>> http://www.isaserver.org/articles_tutorials/
>>> ISA Server Blogs: http://blogs.isaserver.org/
>>> ------------------------------------------------------
>>> Visit TechGenix.com for more information about our other sites:
>>> http://www.techgenix.com
>>> ------------------------------------------------------
>>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>>> Report abuse to listadmin@xxxxxxxxxxxxx
>>>
>>>
>>>
>>
>>
>> ------------------------------------------------------
>> List Archives: //www.freelists.org/archives/isalist/
>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>> ISA Server Articles and Tutorials:
>> http://www.isaserver.org/articles_tutorials/
>> ISA Server Blogs: http://blogs.isaserver.org/
>> ------------------------------------------------------
>> Visit TechGenix.com for more information about our other sites:
>> http://www.techgenix.com
>> ------------------------------------------------------
>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>> Report abuse to listadmin@xxxxxxxxxxxxx
>>
>> ------------------------------------------------------
>> List Archives: //www.freelists.org/archives/isalist/
>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>> ISA Server Articles and Tutorials:
>> http://www.isaserver.org/articles_tutorials/
>> ISA Server Blogs: http://blogs.isaserver.org/
>> ------------------------------------------------------
>> Visit TechGenix.com for more information about our other sites:
>> http://www.techgenix.com
>> ------------------------------------------------------
>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>> Report abuse to listadmin@xxxxxxxxxxxxx
>>
>>
>> ------------------------------------------------------
>> List Archives: //www.freelists.org/archives/isalist/
>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>> ISA Server Articles and Tutorials:
>> http://www.isaserver.org/articles_tutorials/
>> ISA Server Blogs: http://blogs.isaserver.org/
>> ------------------------------------------------------
>> Visit TechGenix.com for more information about our other sites:
>> http://www.techgenix.com
>> ------------------------------------------------------
>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>> Report abuse to listadmin@xxxxxxxxxxxxx
>>
>> ------------------------------------------------------
>> List Archives: //www.freelists.org/archives/isalist/
>> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
>> ISA Server Articles and Tutorials:
>> http://www.isaserver.org/articles_tutorials/
>> ISA Server Blogs: http://blogs.isaserver.org/
>> ------------------------------------------------------
>> Visit TechGenix.com for more information about our other sites:
>> http://www.techgenix.com
>> ------------------------------------------------------
>> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
>> Report abuse to listadmin@xxxxxxxxxxxxx
>>
>>
>>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
>
>
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
