SCOUG-HELP Mailing List Archives

<< Previous Message <<

Date:	Sun, 18 Jul 2004 16:29:23 PDT7
From:	"Bob" <2lvvuss02@sneakemail.com >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: scoug.com & MX

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

** Reply to message from "Peter Skye pskye@peterskye.com" on Sun, 18 Jul 2004
10:04:09 PDT7

> Now I'm trying to figure out what all those SMTP connections are that
> come from ZoneEdit (which is the "backup" and shouldn't be used unless
> the SCOUG server is down). Maybe spammers are sending to every server
> listed in the DNS? Why those sneaky people. (Last night when I
> checked, 4 of the 5 connections were from ZoneEdit. When I just checked
> again, 2 of the 7 connections were from ZoneEdit. I check this at least
> twice a day and these values are pretty typical.)

I have not noticed any of my email going through ZoneEdit, not saying some does
not, just that I have not see it.

The normal procedure is to try the primary email server and if it does not
respond (because it is down or busy) then try the backup email server. The
backup email server, when it receives email for another email server it just
tries to relay the email. If the primary server is down or busy it just holds
the email until it can connect and deliver the email, the primary does not need
to request the email.

> I just checked the SMTP connections one more time and ZoneEdit has been
> pumping _something_ to SCOUG over socket 402 for over ten minutes.
> That's one long message. I waited a few minutes and checked port 402
> again and it was closed. Elapsed connection time was at least 15
> minutes.

I would not expect this. The mail server should only use (inbound) port 25
(SMTP) and 110 (POP) from high ports (>10000). Out bound it should use high
ports (>10000) going to port 25 (SMTP) and 53 (domain name services).

Are you sure this was not for the web site? Something that just occurred to me
was that it also could be the mailing list interface to the email server.

> [much online log checking done here] InetMail doesn't report all
> connections in its logs (very weird indeed). For example, I just
> checked the log for socket 402 and there's nothing, even though that
> connection was closed 40 minutes ago. The log (after I sort it) jumps
> from socket 303 to socket 414. Useless.
>
> *Bob* -- can either Weasel or Communigate give you a log report "by
> socket connection" so you can see what is happening with these long-term
> connections? A report that looks something like this (with select and
> sort capability) would be very helpful:

I don't think so, but I have not checked all the log options. The mail logs
are just that email with date-time, from IP-domain name, and to name. As I
said above there are only a few ports that the email server will use.

--
Robert Blair

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 18 | July | 2004 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.