Generally an increase in POP is only related to two things:

* Email Client has short time out's and long query times.

Seems some* email clients will attempt to download messages, but if the re-query time comes around, it will terminate the first connection and then restart from the beginning.

* Unique identifier related to the message keeps changing.

The email client trusts that the server ID for the message is correct, so if it changes, the email client will consider this as new.

This occurs usually when migrating data stores.



On 16-05-05 06:40 AM, Joseph B wrote:
I was reviewing my flow records and I can see in the last 24h we have
started doing a much larger amount of POP3 traffic to Microsoft than
usual. As an example, some of the IP's that are making the POP3
connections are:

Yes, we started seeing these logins from around April 18th.

Some users have gone from 5MB a day of POP traffic to 25GB per day :-\

May  5 17:31:52 server dovecot: pop3-login: Login:
user=<u...@domain.com>, method=PLAIN, rip=40.100.16.125,
lip=45.xx.xx.xx, mpid=294947, session=<7VRKwRMytG4oZBB9>
May  5 17:31:52 server dovecot: pop3(u...@domain.com): Disconnected:
Logged out top=0/0, retr=0/0, del=0/512, size=223773360, bytes=24/12306

May  5 17:32:17 server dovecot: pop3-login: Login:
user=<u...@domain.com>, method=PLAIN, rip=40.100.16.125,
lip=45.xx.xx.xx, mpid=295053, session=<gaDKwhMypNUoZBB9>
May  5 17:40:34 server dovecot: pop3(u...@domain.com): Disconnected:
Logged out top=2/3772, retr=1024/447566492, del=0/512, size=223773360,
bytes=10074/447591247

Cheers,

Joseph


_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop




--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
------------------------------------------------------------------------
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Reply via email to