Hi all:
I wonder if anybody else has seen something like the following:
Last friday our server received an incoming SMTP connection from a
certain mail server (correo.recol.es, which, BTW, is running "Microsoft
SMTP MAIL"), which increased our incoming bandwidth usage several times
over our average. During the whole weekend and part of Monday the MRTG
graph showed our mail server sucking *lots* of incoming bandwidth, while
netstat showed that practically the only incoming SMTP connection that
lasted all that time was the one coming from correo.recol.es (it was
there during Friday, Saturday and Sundey). This lasted until Monday,
when we killed that qmail-smtpd process manually, and the bandwidth
usage instantly dropped to normal levels.
Yesterday it has happened again. We received last night an incoming
SMTP connection from the same server (correo.recol.es), and the mail
server's bandwidth usage has gone through the roof the whole night. This
morning we kill that qmail-smtpd process, and bandwidth usage decreases
to normal levels again.
My question now is: what's going on?
Since the SMTP connection never ends, I don't really know what the heck
are they trying to send me; plus, it would have needed to be something
really *big*, since the incoming bandwidth usage was on 96 Kbytes/sec.
for the whole weekend; you do the math. Rather than that, I think that
it's probably the other side's mail server being buggy and sending
garbage and never closing the connection properly, so I'm writing here
to see if anyone else has seen something similar.
Paulo Jan.
DDnet.
