[isalist] Re: SMTP Connection Closed
- From: "Thomas W Shinder" <tshinder@xxxxxxxxxxx>
- To: <isalist@xxxxxxxxxxxxx>
- Date: Thu, 18 Jan 2007 20:47:16 -0600
http://www.ISAserver.org
-------------------------------------------------------
Time for network traces. Too bad the crapware Linksys and Sonicwall
don't have built in packet sniffers.
Thomas W Shinder, M.D.
Site: www.isaserver.org
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/3xqb7
MVP -- Microsoft Firewalls (ISA)
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx] On Behalf Of Greg Mulholland
> Sent: Thursday, January 18, 2007 8:42 PM
> To: isalist@xxxxxxxxxxxxx
> Subject: [isalist] Re: SMTP Connection Closed
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> gotta be some sort of connect limit, i would have thought
> noop as well. Have
> you customised any of your smtp rules or smtp filters beyond
> the normal
> setup? have you customised any of the settings exchange
> connection limit
> settings
>
> whats the hardware specs of the exchange box and isa box?
>
> how long do you wait for the before banner before closing the window?
>
>
> Greg
> ----- Original Message -----
> From: "ISA" <ISA@xxxxxxxxxxxxxxxx>
> To: <isalist@xxxxxxxxxxxxx>
> Sent: Friday, January 19, 2007 1:29 PM
> Subject: [isalist] SMTP Connection Closed
>
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
>
> Nothing at all -
> I enter telnet mail.domain.com 25 (hit enter) the line disappears and
> the curser just sits there and blinks - no banner - nothing. If I hit
> enter again it goes back to the C:\ prompt.
>
> I tried the steps in that article mentioned earlier - but I can't get
> passed the first step (mentioned above). However, I see the port 25
> attempt on the ISA firewall logs - then is CLOSES after 5 seconds.
>
>
> Joseph Danielsen, MCSA-Messaging, MCP
>
> Network Blade Inc.
>
> 49 Marcy Street
>
> Somerset, NJ 08873
>
> 732-213-0600
>
> www.networkblade.com
>
>
>
>
>
>
> -----Original Message-----
> From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx]
> On Behalf Of Thor (Hammer of God)
> Posted At: Thursday, January 18, 2007 9:24 PM
> Posted To: ISA
> Conversation: [isalist] SMTP Connection Closed
> Subject: [isalist] Re: SMTP Connection Closed
>
> http://www.ISAserver.org
> -------------------------------------------------------
>
> What actually happens when the telnet session is initiated?
> Do you see
> anything? Any connect at all?
>
> t
>
>
> On 1/18/07 6:10 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
>
> > http://www.ISAserver.org
> > -------------------------------------------------------
> >
> > Thanks guys - I'll follow the article is see what goes -
> >
> > Did anyone have any problems actually connecting?
> >
> > I also thought of MTU issues. Two of the sites that can not connect;
> one
> > is fronted with a SonicWall, the other a Linksys (stop,
> don't even say
> > it... I know).
> >
> >
> >
> > Joseph Danielsen, MCSA-Messaging, MCP
> >
> > -----Original Message-----
> > From: isalist-bounce@xxxxxxxxxxxxx
> [mailto:isalist-bounce@xxxxxxxxxxxxx]
> > On Behalf Of Greg Mulholland
> > Posted At: Thursday, January 18, 2007 8:58 PM
> > Posted To: ISA
> > Conversation: [isalist] Re: SMTP Connection Closed
> > Subject: [isalist] Re: SMTP Connection Closed
> >
> > http://www.ISAserver.org
> > -------------------------------------------------------
> >
> > I'm wondering if he is experiencing any other signs of
> flaky internet
> > connection. Like in browsing etc etc. Ive seen mtu issues do this.
> >
> > Greg
> > ----- Original Message -----
> > From: "Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>
> > To: <isalist@xxxxxxxxxxxxx>
> > Sent: Friday, January 19, 2007 12:49 PM
> > Subject: [isalist] Re: SMTP Connection Closed
> >
> >
> >> http://www.ISAserver.org
> >> -------------------------------------------------------
> >>
> >> But that wouldn't have anything at all to do with telnetting to 25,
> > which
> >> I
> >> can do, but I now see that others cannot. A blacklist or etc will
> not
> >> affect that.
> >>
> >> t
> >>
> >>
> >> On 1/18/07 4:29 PM, "Amy Babinchak"
> <amy@xxxxxxxxxxxxxxxxxxxxxxxxxx>
> >> spoketh
> >> to all:
> >>
> >>> It only effects incoming email.
> >>>
> >>> You can get around it by using a smarthost. Your cable company
> > probably
> >>> allows
> >>> you to use their server for such purpose. That's how I get around
> it.
> >>>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
> >>> Sent: Thu 1/18/2007 7:22 PM
> >>> To: isalist@xxxxxxxxxxxxx
> >>> Subject: [isalist] SMTP Connection Closed
> >>>
> >>>
> >>> I thought that would affect my outgoing mail - not incoming!
> >>>
> >>> <unfortunately I can't get a static IP for another few months, I
> will
> >
> >>> then>
> >>>
> >>> Joseph Danielsen, MCSA-Messaging, MCP
> >>> Network Blade Inc.
> >>> 49 Marcy Street
> >>> Somerset, NJ 08873
> >>> 732-213-0600
> >>> www.networkblade.com <http://www.networkblade.com/>
> >>>
> >>>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/image001.jpg>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/image002.jpg>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> >>> On
> >>> Behalf Of Amy Babinchak
> >>> Sent: Thursday, January 18, 2007 7:20 PM
> >>> To: isalist@xxxxxxxxxxxxx
> >>> Subject: RE: [isalist] SMTP Connection Closed
> >>>
> >>> according to dsnstuff.com you are listed on 3 blacklists
> and have no
> >>> reverse
> >>> DNS entry. That's enough right there to cause you to have
> > inconsistant
> >>> incoming email issues.
> >>>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
> >>> Sent: Thu 1/18/2007 7:06 PM
> >>> To: isalist@xxxxxxxxxxxxx
> >>> Subject: [isalist] SMTP Connection Closed
> >>> Amy:
> >>> DNS seems to be working (mail.networkblade.com resolves to the
> > correct
> >>> IP),
> >>> "I" am not blacklisting and I don't know how to Grey list.
> >>>
> >>> The ISP (cable company) is always suspect of everything else.
> >>>
> >>> Joseph Danielsen, MCSA-Messaging, MCP
> >>> Network Blade Inc.
> >>> 49 Marcy Street
> >>> Somerset, NJ 08873
> >>> 732-213-0600
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> >>> On
> >>> Behalf Of Amy Babinchak
> >>> Sent: Thursday, January 18, 2007 7:02 PM
> >>> To: isalist@xxxxxxxxxxxxx
> >>> Subject: RE: [isalist] SMTP Connection Closed
> >>>
> >>> So assuming that this used to work you've eliminated the other
> > obvious
> >>> things
> >>> besides filtering like bad DNS, flakey ISP, blacklisting, grey
> > listing,
> >>> etc?
> >>>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx on behalf of ISA
> >>> Sent: Thu 1/18/2007 6:46 PM
> >>> To: isalist@xxxxxxxxxxxxx
> >>> Subject: [isalist] SMTP Connection Closed
> >>> Good questions!
> >>> Thor: I was referring to Exchange filtering NOT ISA. I
> was not aware
> > of
> >>> the
> >>> NOOP config in the SMTP filter properties.
> >>> Amy: By client I mean another account with a separate ISP and
> > Exchange
> >>> server
> >>> somewhere else in the world. i.e. NJ.
> >>>
> >>> Joseph Danielsen, MCSA-Messaging, MCP
> >>> Network Blade Inc.
> >>> 49 Marcy Street
> >>> Somerset, NJ 08873
> >>> 732-213-0600
> >>> www.networkblade.com <http://www.networkblade.com/>
> >>>
> >>>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/%20>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/%20>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> >>> On
> >>> Behalf Of Thor (Hammer of God)
> >>> Posted At: Thursday, January 18, 2007 6:40 PM
> >>> Posted To: ISA
> >>> Conversation: [isalist] SMTP Connection Closed
> >>> Subject: [isalist] Re: SMTP Connection Closed
> >>>
> >>> Just to make sure we're saying the same thing.. Not filtering via
> >>> Exchange and
> >>> 3rd party- the ISA SMTP filter. You disabled that?
> >>>
> >>> t
> >>>
> >>>
> >>> On 1/18/07 3:30 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
> >>> Thor - thanks but I've turned off ALL filtering via
> Exchange and 3rd
> >>> party
> >>> software.
> >>>
> >>> I've tried connecting (via telnet) from multiple
> locations (ISP) and
> > from
> >>> Exchange 2003 and SBS 2003. Some work and Some don't.
> When watching
> > the
> >>> ISA
> >>> real-time logs, the connection is initiated then 5
> seconds later it
> > is
> >>> then
> >>> closed by the Exchange publishing rule.
> >>>
> >>> A 12-pack for the one who gets this one!
> >>>
> >>> <and this is on my own server/network>
> >>>
> >>>
> >>> Joseph Danielsen, MCSA-Messaging, MCP
> >>> Network Blade Inc.
> >>> 49 Marcy Street
> >>> Somerset, NJ 08873
> >>> 732-213-0600
> >>> www.networkblade.com <http://www.networkblade.com/>
> >>> <http://www.networkblade.com/>
> >>>
> >>>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/%20>
> >>>
> >
> <https://harbor.bounceme.net/Exchange/amy/Drafts/RE:%20[isalis
> t]%20SMTP%
> > 20Conn
> >>> ection%20Closed.EML/1_multipart/%20>
> >>> ________________________________
> >>>
> >>> From: isalist-bounce@xxxxxxxxxxxxx
> > [mailto:isalist-bounce@xxxxxxxxxxxxx]
> >>> <mailto:isalist-bounce@xxxxxxxxxxxxx%5d> On Behalf Of
> Thor (Hammer
> > of
> >>> God)
> >>> Posted At: Thursday, January 18, 2007 6:22 PM
> >>> Posted To: ISA
> >>> Conversation: [isalist] SMTP Connection Closed
> >>> Subject: [isalist] Re: SMTP Connection Closed
> >>>
> >>> Check your SMTP filter settings for command lengths...
> NOOP has been
> >>> problematic before at its default of 6 - I changed mine
> to 20 after
> >>> sniffing
> >>> traffic and determining some older Exchange boxes were
> padding NOOP
> > with
> >>> spaces..
> >>>
> >>> t
> >>>
> >>>
> >>> On 1/18/07 1:46 PM, "ISA" <ISA@xxxxxxxxxxxxxxxx> spoketh to all:
> >>> Hope someone can help!
> >>>
> >>> I think this is an ISA 2004 (patched) issue.
> >>>
> >>> From some clients I can send/receive email just fine (and telnet
> port
> >
> >>> 25). But
> >>> from other clients I can not. I monitored the ISA logs
> and observed
> > the
> >>> connection initiated then being closed.
> >>>
> >>> From Exchange 2003 box I shut of IMF and GFI services - still not
> > luck
> >>> receiving email or telnet'ing from a particular client.
> >>>
> >>> Any ideas would be greatly appreciated.
> >>>
> >>> Respectfully
> >>>
> >>>
> >>> Joseph Danielsen, MCSA-Messaging, MCP
> >>> Network Blade Inc.
> >>> 49 Marcy Street
> >>> Somerset, NJ 0887
> >>> 732-213-0600
> >>>
> >>
> >>
> >> ------------------------------------------------------
> >> List Archives: //www.freelists.org/archives/isalist/
> >> ISA Server Newsletter:
> http://www.isaserver.org/pages/newsletter.asp
> >> ISA Server Articles and Tutorials:
> >> http://www.isaserver.org/articles_tutorials/
> >> ISA Server Blogs: http://blogs.isaserver.org/
> >> ------------------------------------------------------
> >> Visit TechGenix.com for more information about our other sites:
> >> http://www.techgenix.com
> >> ------------------------------------------------------
> >> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> >> Report abuse to listadmin@xxxxxxxxxxxxx
> >>
> >>
> >
> > ------------------------------------------------------
> > List Archives: //www.freelists.org/archives/isalist/
> > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > ISA Server Articles and Tutorials:
> > http://www.isaserver.org/articles_tutorials/
> > ISA Server Blogs: http://blogs.isaserver.org/
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > Report abuse to listadmin@xxxxxxxxxxxxx
> >
> > ------------------------------------------------------
> > List Archives: //www.freelists.org/archives/isalist/
> > ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> > ISA Server Articles and Tutorials:
> > http://www.isaserver.org/articles_tutorials/
> > ISA Server Blogs: http://blogs.isaserver.org/
> > ------------------------------------------------------
> > Visit TechGenix.com for more information about our other sites:
> > http://www.techgenix.com
> > ------------------------------------------------------
> > To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> > Report abuse to listadmin@xxxxxxxxxxxxx
> >
> >
> >
>
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
>
> ------------------------------------------------------
> List Archives: //www.freelists.org/archives/isalist/
> ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
> ISA Server Articles and Tutorials:
> http://www.isaserver.org/articles_tutorials/
> ISA Server Blogs: http://blogs.isaserver.org/
> ------------------------------------------------------
> Visit TechGenix.com for more information about our other sites:
> http://www.techgenix.com
> ------------------------------------------------------
> To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
> Report abuse to listadmin@xxxxxxxxxxxxx
>
>
>
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
