SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Sun, 18 Jul 2004 10:04:09 PDT7
From:	Peter Skye <pskye@peterskye.com >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: scoug.com & MX

Content Type: text/plain

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

Steven Levine wrote:
>
> >AFAIK the higher preference value means a higher priority
> >for the specified MX. If pref=100 means (in this case)
> >"use this one" then SCOUG mail goes through ZoneEdit.
>
> I had to look this up to verify my memory (rfc 1034).
> Lower is better, so ZoneEdit is the backup.

Okay, that's my problem. The 16-bit value for preference is "0 highest,
65535 lowest". My neurons were misconfigured.

Now I'm trying to figure out what all those SMTP connections are that
come from ZoneEdit (which is the "backup" and shouldn't be used unless
the SCOUG server is down). Maybe spammers are sending to every server
listed in the DNS? Why those sneaky people. (Last night when I
checked, 4 of the 5 connections were from ZoneEdit. When I just checked
again, 2 of the 7 connections were from ZoneEdit. I check this at least
twice a day and these values are pretty typical.)

I just checked the SMTP connections one more time and ZoneEdit has been
pumping _something_ to SCOUG over socket 402 for over ten minutes.
That's one long message. I waited a few minutes and checked port 402
again and it was closed. Elapsed connection time was at least 15
minutes.

[much online log checking done here] InetMail doesn't report all
connections in its logs (very weird indeed). For example, I just
checked the log for socket 402 and there's nothing, even though that
connection was closed 40 minutes ago. The log (after I sort it) jumps
from socket 303 to socket 414. Useless.

*Bob* -- can either Weasel or Communigate give you a log report "by
socket connection" so you can see what is happening with these long-term
connections? A report that looks something like this (with select and
sort capability) would be very helpful:

----------------- SMTP Incoming Report ------------------
---------- Time ---------- ---- From ---- Total
Connect Disconnect Total Socket IP Domain Bytes
======= ========== ===== ====== ====== ====== =====

where the "Domain" column is a lookup of the "IP" value.

If I could see reports like the above I would know where our large-time
and large-traffic connections are coming from. Writing the report is
trivial; it's the completeness of the log files that is important.

> Oddly:
>
> [D:\TMP]nslookup scoug.com ns1.zoneedit.com
> Server: ns1.zoneedit.com
> Address: 207.234.248.200
>
> Non-authoritative answer:
> Name: scoug.com
> Address: 216.184.211.35
>
> Which means something is confused about authority.

Hmm. This is the A record info. What do you see that's confusing?
Reporting only the cached value?

- Peter

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 18 | July | 2004 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.