[Mimedefang] Strange activity

[David F. Skoll]

Jan Pieter Cornet wrote:

> Are you sure they just sit there after the initial connect? If so, you should
> also see the "did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA"
> message logged at the same time as the timeout.

Does Sendmail log that message if *it* closes the connection?  I thought it
only did so if the client closes the connection.

They may not actually be sitting doing nothing.  I traced one which issued
a RCPT command and then sat for over 10 minutes doing nothing.  I killed
it after 10 minutes, so don't know if it ever would have issued another
command.

> Our logs don't go back very far, but I haven't seen a recent huge increase,
> at least not since december 30th. I see in our logs about 1000 - 2000
> per hour of these, which I consider background noise on our mail volume.
> Most of these seem to be "lost input channel from ... to MTA after rcpt",
> so that seems more like (dictionary) scanning.

We see a lot of these, but hardly any "timeout waiting for input from
[xx.xx.xx.xx] during server cmd read" except on this one client's
systems.

Regards,

David.