Ok cool... the world dosen't hate me.
How can I limit my exposure to this in the future??? I'm sure this has to
have been discussed.... is there an archive / URL?
Paul Farber
Farber Technology
[EMAIL PROTECTED]
Ph 570-628-5303
Fax 570-628-5545
On Mon, 27 Sep 1999, Chris Johnson wrote:
> On Mon, Sep 27, 1999 at 07:01:34PM -0400, [EMAIL PROTECTED] wrote:
> > I find it hard to believe that I am getting mail bombed from
> > petopia.com but the logs show:
> >
> > [root@mail log]# grep 216.33.225.124 maillog -c
> > 195494
> >
> > Sep 26 11:58:14 mail qmail-smptd: 938361494.243103 tcpserver: pid 2649 num
> > 0 from 216.33.225.124
> > Sep 26 11:58:14 mail qmail-smptd: 938361494.253880 tcpserver: ok 2649
> > mail.f-tech.net:207.44.65.16:25 :216.33.225.124::1334
> > Sep 26 11:58:14 mail qmail-smptd: 938361494.775457 tcpserver: end 2649
> > status 256
> >
> > Are there any known problema with tcpserver looping???
>
> What do you mean by "looping"?
>
> It appears that 216.33.225.124 is connecting to you repeatedly. I'd bet that
> the remote host is trying to send you a message with a bare linefeed,
> qmail-smtpd is disconnecting, and then the remote host is connecting again
> immediately to try to resend the message. I'd bet a zillion dollars that the
> remote host is running a brain-dead Windows MTA.
>
> My suspicions are confirmed:
>
> [cjohnson@mail cjohnson]$ telnet 216.33.225.124 25
> Trying 216.33.225.124...
> Connected to petweb02.petopia.com.
> Escape character is '^]'.
> 220-petweb02.petopia.com Microsoft SMTP MAIL ready at Mon, 27 Sep 1999 18:08:00
>-0700 Version: 5.5.1877.977.9
> 220 ESMTP spoken here
>
> I'd cut them off with a tcpserver rule.
>
> Chris
>
