[Mimedefang] Strange activity
David F. Skoll
dfs at roaringpenguin.com
Thu Jan 5 10:17:53 EST 2006
Jan Pieter Cornet wrote:
> Are you sure they just sit there after the initial connect? If so, you should
> also see the "did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA"
> message logged at the same time as the timeout.
Does Sendmail log that message if *it* closes the connection? I thought it
only did so if the client closes the connection.
They may not actually be sitting doing nothing. I traced one which issued
a RCPT command and then sat for over 10 minutes doing nothing. I killed
it after 10 minutes, so don't know if it ever would have issued another
command.
> Our logs don't go back very far, but I haven't seen a recent huge increase,
> at least not since december 30th. I see in our logs about 1000 - 2000
> per hour of these, which I consider background noise on our mail volume.
> Most of these seem to be "lost input channel from ... to MTA after rcpt",
> so that seems more like (dictionary) scanning.
We see a lot of these, but hardly any "timeout waiting for input from
[xx.xx.xx.xx] during server cmd read" except on this one client's
systems.
Regards,
David.
More information about the MIMEDefang
mailing list