On Tue, Jun 29, 2010 at 11:38 AM, Ivan Lezhnjov Jr. <[email protected]> wrote: > I tried tcpdump, as you suggested, and what it reported was that apparently > communication was being established at port 25 but for whatever reason GMail > wouldn't respond: > > GMail > r...@roosevelt:/home/ilj % tcpdump -ni eth0 host 74.125.43.27 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes > 12:19:08.251414 IP 91.194.239.113.41831 > 74.125.43.27.25: Flags [S], seq > 53304775, win 5840, options [mss 1460,sackOK,TS val 120648163 ecr 0,nop,wscale > 6], length 0 > 12:19:11.251229 IP 91.194.239.113.41831 > 74.125.43.27.25: Flags [S], seq > 53304775, win 5840, options [mss 1460,sackOK,TS val 120649063 ecr 0,nop,wscale > 6], length 0 > 12:19:17.251213 IP 91.194.239.113.41831 > 74.125.43.27.25: Flags [S], seq > 53304775, win 5840, options [mss 1460,sackOK,TS val 120650863 ecr 0,nop,wscale > 6], length 0 > ^C > 3 packets captured > 6 packets received by filter > 0 packets dropped by kernel > > I tried another e-mail service which is very popular and pretty decent in the > RuNet, the Yandex.Mail. All in all, the result was exactly the same: > > Yandex > r...@roosevelt:/home/ilj % tcpdump -ni eth0 host 77.88.21.38 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes > 18:07:17.642244 IP 91.194.239.113.50441 > 77.88.21.38.25: Flags [S], seq > 1208570375, win 5840, options [mss 1460,sackOK,TS val 126914980 ecr > 0,nop,wscale 6], length 0 > 18:07:20.639119 IP 91.194.239.113.50441 > 77.88.21.38.25: Flags [S], seq > 1208570375, win 5840, options [mss 1460,sackOK,TS val 126915880 ecr > 0,nop,wscale 6], length 0 > 18:07:26.639116 IP 91.194.239.113.50441 > 77.88.21.38.25: Flags [S], seq > 1208570375, win 5840, options [mss 1460,sackOK,TS val 126917680 ecr > 0,nop,wscale 6], length 0 > ^C > 3 packets captured > 3 packets received by filter > 0 packets dropped by kernel > > For whatever reason the SMTP servers' replies wouldn't come in to my router. > The firewall is out of question so it's something else. > >
Could your ISP be blocking traffic to these servers? You could try using telnet or netcat to connect to them. If that fails in the same way, then something is blocking the access and it isn't just the ossec-maild having issues.
