On Tuesday 21 June 2005 13:00, Sorin Savastre wrote:
> Si de la mine se intmpla exact la fel. Ai incercat si din windows?
>
> >De la mine merge incet (prin RDS)
> >Dar ma gandesc sa nu fie ceva legat de DNS: fie incearca sa-mi rezolve
> >numele, fie incearca sa-si faca reverse la al lui.... nu mai folosesc de
> >cativa ani sendmail, dar stiu ca in configuratiile default parca avea
> >asemenea comportari...
> >Zic asta pentru ca dupa ce raspunde incet la telnet, restul protocolului
> >merge repede (helo ... helo , mail from... rcpt to ... instant.)
> >
> >Sorin Savastre wrote:
> >>Mike wrote:
De ce mai intrebi pe lista daca nu iei in seama raspunsurile pe care le
primesti ? Deja ti s-a recomandat sa folosesti tcpdump sa vezi ce se
intampla. Asta trebuia tu sa faci:
### Cat dureaza conectarea ?
# time { echo "quit" | nc joker.elko.ro 25; }
220 joker.tds.ro ESMTP Sendmail 8.9.3/8.9.3; Tue, 21 Jun 2005 10:06:34 GMT
221 joker.tds.ro closing connection
real 0m30.671s
user 0m0.001s
sys 0m0.003s
### Hm, 30 de secunde, cam mult...
### Atunci noroc ca am dat un tcpdump
# tcpdump host joker.elko.ro
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:37:37.022016 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: S 1627390708:1627390708(0) win 5840
<mss 1460,sackOK,timestamp 1621717812 0,nop,wscale 0>
12:37:37.023330 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: S 2497885657:2497885657(0) ack 1627390709 win 5792 <mss
1460,sackOK,timestamp 34632337 1621717812,nop,wscale 0>
12:37:37.023389 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: . ack 1 win 5840 <nop,nop,timestamp
1621717814 34632337>
12:37:37.031660 IP unassigned-84-234-98-82.fibernet.ro.3693 >
80.86.106.45.auth: S 2499084070:2499084070(0) win 5840 <mss
1460,sackOK,timestamp 34632338 0,nop,wscale 0>
12:37:40.031905 IP unassigned-84-234-98-82.fibernet.ro.3693 >
80.86.106.45.auth: S 2499084070:2499084070(0) win 5840 <mss
1460,sackOK,timestamp 34632638 0,nop,wscale 0>
12:37:46.032585 IP unassigned-84-234-98-82.fibernet.ro.3693 >
80.86.106.45.auth: S 2499084070:2499084070(0) win 5840 <mss
1460,sackOK,timestamp 34633238 0,nop,wscale 0>
12:37:58.034908 IP unassigned-84-234-98-82.fibernet.ro.3693 >
80.86.106.45.auth: S 2499084070:2499084070(0) win 5840 <mss
1460,sackOK,timestamp 34634438 0,nop,wscale 0>
12:38:07.041562 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: P 1:77(76) ack 1 win 5792 <nop,nop,timestamp 34635338
1621717814>
12:38:07.041611 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: . ack 77 win 5840 <nop,nop,timestamp
1621747836 34635338>
12:38:13.085388 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: P 1:7(6) ack 77 win 5840
<nop,nop,timestamp 1621753881 34635338>
12:38:13.087192 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: . ack 7 win 5792 <nop,nop,timestamp 34635942 1621753881>
12:38:13.087985 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: P 77:114(37) ack 7 win 5792 <nop,nop,timestamp 34635943
1621753881>
12:38:13.087998 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: . ack 114 win 5840 <nop,nop,timestamp
1621753884 34635943>
12:38:13.088229 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: F 114:114(0) ack 7 win 5792 <nop,nop,timestamp 34635943
1621753881>
12:38:13.095003 IP 80.86.106.45.59382 >
unassigned-84-234-98-82.fibernet.ro.smtp: F 7:7(0) ack 115 win 5840
<nop,nop,timestamp 1621753891 34635943>
12:38:13.096592 IP unassigned-84-234-98-82.fibernet.ro.smtp >
80.86.106.45.59382: . ack 8 win 5792 <nop,nop,timestamp 34635943 1621753891>
### Aha, interesant, cat timp astept banner-ul sendmail-ul incearca de zor
### sa se conecteze pe auth(113).
### Atunci sa incercam ceva...
# iptables -I INPUT -p tcp --dport auth -j ACCEPT
# time { echo "quit"| nc joker.elko.ro 25; }
220 joker.tds.ro ESMTP Sendmail 8.9.3/8.9.3; Tue, 21 Jun 2005 10:04:37 GMT
221 joker.tds.ro closing connection
real 0m0.037s
user 0m0.005s
sys 0m0.003s
### AHA !
Mihai
--
This message was scanned for spam and viruses by BitDefender.
For more information please visit http://www.bitdefender.com/
---
Detalii despre listele noastre de mail: http://www.lug.ro/
