[Mimedefang] error write(L) returned -1, expected 50: Broken pipe

[Marcus Schopen]

Hi,

I started a tcpdump which shows a lot of TCP Retransmission from the 
sending server, while my server is always answering with an ACK:

---------------------------
787	10404.027462	83.19.xx.xx	211.xx.xx.xx	TCP	orbix-locator > smtp [SYN]
Seq=0 Win=65535 Len=0 MSS=1460 WS=5

788	10404.027481	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > orbix-locator [SYN,
ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 WS=6

789	10404.044224	83.19.xx.xx	211.xx.xx.xxTCP	orbix-
locator > smtp [ACK] Seq=1 Ack=1 Win=1048576 Len=0789	

790	10407.046338	211.xx.xx.xx	83.19.xx.xx	SMTP	S: 220 
mx.mydomain.de ESMTP MyDomain Mailer; Mon, 29 Aug 2011 16:31:31 +0200 
(CET)

791	10407.063540	83.19.xx.xx	211.xx.xx.xx
SMTP	C: EHLO domino.senderdomain.de

792	10407.063556	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
orbix-locator [ACK] Seq=88 Ack=24 Win=5888 Len=0

793	10407.063748	211.xx.xx.xx	83.19.xx.xx	SMTP	S: 250-
mx.mydomain.de Hello domino.senderdomain.de [83.19.xx.xx], pleased to 
meet you | 250-ENHANCEDSTATUSCODES | 250-PIPELINING | 250-8BITMIME |
250-SIZE 41943040 | 250-ETRN | 250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
| 250-STARTTLS | 250-DELIVERBY | 250 HELP

794	10407.082584	83.19.xx.xx	211.xx.xx.xx
SMTP	C: MAIL FROM:<firstname.lastname at senderdomain.de> SIZE=125838 |
RCPT TO:<info at recipdomain.de> | DATA

795	10407.086341	211.xx.xx.xx	83.19.xx.xx	SMTP	S: 250 
2.1.0 <firstname.lastname at senderdomain.de>... Sender ok | 250 2.1.5 
<info at recipdomain.de>... Recipient ok | 354 Enter mail, end with "." on
a line by itself

796	10407.113082	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP 
Previous segment lost] C: DATA fragment, 1460 bytes

797	10407.113097	211.xx.xx.xx	83.19.xx.xx	TCP	[TCP Dup ACK 795#1] smtp >
orbix-locator [ACK] Seq=485 Ack=112 Win=5888 Len=0 
SLE=4206 SRE=5666

798	10408.929021	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP Retransmission] C:
DATA fragment, 1460 bytes

799	10408.929036	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
orbix-locator [ACK] Seq=485 Ack=1572 Win=8768 Len=0 SLE=4206 SRE=5666

800	10408.948966	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP 
Retransmission] C: DATA fragment, 1460 bytes

801	10408.948981	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
orbix-locator [ACK] Seq=485 Ack=3032 Win=11712 Len=0 SLE=4206 SRE=5666

802	10408.951928	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP Retransmission] C:
DATA fragment, 1460 bytes803	

803	10408.951942	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
orbix-locator [ACK] Seq=485 Ack=5666 Win=14656 Len=0 SLE=4206 

804	10408.968860	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP Retransmission] C:
DATA fragment, 1460 bytes
[...]

987	12529.161226	83.19.xx.xx	211.xx.xx.xx	TCP	[TCP Previous segment
lost] cesdinv > smtp [PSH, ACK] Seq=90632 Ack=485 Win=1048064 Len=0

988	12557.025842	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP Retransmission] C:
DATA fragment, 1460 bytes

989	12557.025861	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
gte-samp [ACK] Seq=485 Ack=128592 Win=64128 Len=0

990	12557.044861	83.19.xx.xx	211.xx.xx.xx	IMF	subject: [restricted]

991	12557.082295	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
gte-samp [ACK] Seq=485 Ack=129238 Win=64128 Len=0

992	12557.186893	211.xx.xx.xx	83.19.xx.xx	SMTP	S: 451 
4.3.2 Please try again later

993	12557.186905	211.xx.xx.xx	83.19.xx.xx	TCP	smtp > 
gte-samp [FIN, ACK] Seq=519 Ack=129238 Win=64128 Len=0

994	12557.203527	83.19.xx.xx	211.xx.xx.xx	TCP	gte-samp 

995	12557.203656	83.19.xx.xx	211.xx.xx.xx	TCP	gte-samp 

996	12640.632093	83.19.xx.xx	211.xx.xx.xx	SMTP	[TCP Retransmission] C:
DATA fragment, 1460 bytes
---------------------------

After 2.5  hours the email is transmitted completely (ending with an
".", checked by follow tcpstream in wireshard), but the sendmail or the
milter ignore this and send a "reject=451 4.3.2 Please try again later".
Why? It is strange that the sending servers needs up to 120 seconds to
respond to an immediately ACK and answers with a Retransmission then.
But even if the whole session takes 2.5 hours and I don't want to wait
that long for such a small mail to be transmitted, I'd like to know
which parameter/option is responsible for the timeout on my side. And is
this just a strange network problem (MTU, firefall on sending side) or
possibly my problem (as I sayed never seen such an error sind 2000K
mails running through this system and only caused by this single
server).

Ciao
Marcus