On Tue, Dec 29, 2020 at 06:03:10PM +0700, Victor Sudakov via Exim-users wrote: > Evgeniy Berdnikov via Exim-users wrote: > > On Tue, Dec 29, 2020 at 10:20:51AM +0700, Victor Sudakov via Exim-users > > wrote: > > > The packet dump is available at http://admin.sibptus.ru/~vas/2.pcap > > > You can see from it that exim's host opens a TCP connection to the > > > clamav host, the clamav host replies with SYN+ACK, but the exim host > > > sends a TCP RST > > > immediately. Why could that happen? > > > > Normally tcp connection initiator should respond with ACK to SYN+ACK. > > Have you looked at the actual packet dump? I mean, don't trust my word.
Yes, I have. And have you looked at packet time stamps? IMHO, 3-5 us time interval between SYN-ACK and RST is too low for userspace responce. However, get strace as Jeremy suggested. I expect ECONNREFUSED on connect(). -- Eugene Berdnikov -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
