Loading ...
Sorry, an error occurred while loading the content.
 

lost connection after DATA

Expand Messages
  • Patrick - South Valley Internet
    Hi all, Now that the mail server is all good to go again, we re having an issue with one of our customers, and only one. They are telling us that
    Message 1 of 8 , Oct 5, 2006
      Hi all,

      Now that the mail server is all good to go again, we're having an issue
      with one of our customers, and only one. They are telling us that
      approximately 1 out of 2 emails don't get sent. Here's what I found in
      the logs:


      Oct 5 05:03:21 birch postfix/smtpd[162104]: lost connection after RCPT
      from artemis.dmz.transedge.com[216.217.188.15]
      Oct 5 05:03:21 birch postfix/smtpd[162104]: disconnect from
      artemis.dmz.transedge.com[216.217.188.15]
      Oct 5 05:50:57 birch postfix/smtpd[138124]: connect from
      artemis.dmz.transedge.com[216.217.188.15]
      Oct 5 05:51:57 birch postfix/smtpd[138124]: 98C1E85:
      client=artemis.dmz.transedge.com[216.217.188.15]
      Oct 5 05:51:57 birch postfix/smtpd[138124]: lost connection after DATA
      from artemis.dmz.transedge.com[216.217.188.15]
      Oct 5 05:51:57 birch postfix/smtpd[138124]: disconnect from
      artemis.dmz.transedge.com[216.217.188.15]

      Since this is the only customer that is receiving this error message,
      we're a little confused as to what the problem could be.

      Any ideas?

      Thanks in advance.

      Patrick
    • mouss
      ... do you think we can guess whether artemis.* is your server, your client server or a foreign server? Anyway, start by looking at/for: - intermediary
      Message 2 of 8 , Oct 5, 2006
        Patrick - South Valley Internet wrote:
        > Hi all,
        >
        > Now that the mail server is all good to go again, we're having an
        > issue with one of our customers, and only one. They are telling us
        > that approximately 1 out of 2 emails don't get sent. Here's what I
        > found in the logs:
        >
        >
        > Oct 5 05:03:21 birch postfix/smtpd[162104]: lost connection after RCPT
        > from artemis.dmz.transedge.com[216.217.188.15]
        > Oct 5 05:03:21 birch postfix/smtpd[162104]: disconnect from
        > artemis.dmz.transedge.com[216.217.188.15]
        > Oct 5 05:50:57 birch postfix/smtpd[138124]: connect from
        > artemis.dmz.transedge.com[216.217.188.15]
        > Oct 5 05:51:57 birch postfix/smtpd[138124]: 98C1E85:
        > client=artemis.dmz.transedge.com[216.217.188.15]
        > Oct 5 05:51:57 birch postfix/smtpd[138124]: lost connection after DATA
        > from artemis.dmz.transedge.com[216.217.188.15]
        > Oct 5 05:51:57 birch postfix/smtpd[138124]: disconnect from
        > artemis.dmz.transedge.com[216.217.188.15]
        >
        > Since this is the only customer that is receiving this error message,
        > we're a little confused as to what the problem could be.
        >
        > Any ideas?


        do you think we can guess whether artemis.* is your server, your client
        server or a "foreign" server?

        Anyway, start by looking at/for:
        - intermediary proxies/routers/firewalls
        - pipelining bugs

        if nothing comes out, read the DEBUG_README and post more information.
      • Patrick - South Valley Internet
        I guess that information would help. artemis is the clients server. birch is our server. Are you saying that this may/may not be a firewall issue on the
        Message 3 of 8 , Oct 5, 2006
          I guess that information would help.

          artemis is the clients server. birch is our server.

          Are you saying that this may/may not be a firewall issue on the client's
          side? Also, I'll take a look at the DEBUG_README and post back.

          Thanks for the response mouss.

          Patrick




          mouss wrote:
          > Patrick - South Valley Internet wrote:
          >> Hi all,
          >>
          >> Now that the mail server is all good to go again, we're having an
          >> issue with one of our customers, and only one. They are telling us
          >> that approximately 1 out of 2 emails don't get sent. Here's what I
          >> found in the logs:
          >>
          >>
          >> Oct 5 05:03:21 birch postfix/smtpd[162104]: lost connection after
          >> RCPT from artemis.dmz.transedge.com[216.217.188.15]
          >> Oct 5 05:03:21 birch postfix/smtpd[162104]: disconnect from
          >> artemis.dmz.transedge.com[216.217.188.15]
          >> Oct 5 05:50:57 birch postfix/smtpd[138124]: connect from
          >> artemis.dmz.transedge.com[216.217.188.15]
          >> Oct 5 05:51:57 birch postfix/smtpd[138124]: 98C1E85:
          >> client=artemis.dmz.transedge.com[216.217.188.15]
          >> Oct 5 05:51:57 birch postfix/smtpd[138124]: lost connection after
          >> DATA from artemis.dmz.transedge.com[216.217.188.15]
          >> Oct 5 05:51:57 birch postfix/smtpd[138124]: disconnect from
          >> artemis.dmz.transedge.com[216.217.188.15]
          >>
          >> Since this is the only customer that is receiving this error message,
          >> we're a little confused as to what the problem could be.
          >>
          >> Any ideas?
          >
          >
          > do you think we can guess whether artemis.* is your server, your
          > client server or a "foreign" server?
          >
          > Anyway, start by looking at/for:
          > - intermediary proxies/routers/firewalls
          > - pipelining bugs
          >
          > if nothing comes out, read the DEBUG_README and post more information.
          >
          >
          >
        • Wietse Venema
          ... They send DATA and close the connection in the same second? That sounds like a broken client (perhaps a mis-configured microsoft server). A tcpdump
          Message 4 of 8 , Oct 5, 2006
            Patrick - South Valley Internet:
            > Oct 5 05:50:57 birch postfix/smtpd[138124]: connect from
            > artemis.dmz.transedge.com[216.217.188.15]
            > Oct 5 05:51:57 birch postfix/smtpd[138124]: 98C1E85:
            > client=artemis.dmz.transedge.com[216.217.188.15]
            > Oct 5 05:51:57 birch postfix/smtpd[138124]: lost connection after DATA
            > from artemis.dmz.transedge.com[216.217.188.15]
            > Oct 5 05:51:57 birch postfix/smtpd[138124]: disconnect from
            > artemis.dmz.transedge.com[216.217.188.15]

            They send DATA and close the connection in the same second?
            That sounds like a broken client (perhaps a mis-configured
            microsoft server). A tcpdump recording can clear this up.

            http://www.postfix.org/DEBUG_README.html

            Wietse
          • Dehnert James Sr
            I have been seeing these lost connection after DATA messages coming from an upstream connection. brief snippet... Jun 28 15:52:14 mail1 postfix/smtpd[394]:
            Message 5 of 8 , Jun 28, 2007
              I have been seeing these lost connection after DATA messages coming
              from an upstream connection.

              brief snippet...

              Jun 28 15:52:14 mail1 postfix/smtpd[394]: C0727306820:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:14 mail1 postfix/smtpd[394]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:14 mail1 postfix/smtpd[394]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:14 mail1 postfix/cleanup[505]: C0727306820: message-
              id=<200706271806.l5RI6ASm010789@...>
              Jun 28 15:52:17 mail1 postfix/smtpd[394]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:17 mail1 postfix/smtpd[394]: 75839306820:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:17 mail1 postfix/smtpd[394]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:17 mail1 postfix/smtpd[394]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:17 mail1 postfix/cleanup[505]: 75839306820: message-
              id=<b3b801c7b58d$01c7b58d$f623797c@...>
              Jun 28 15:52:22 mail1 postfix/smtpd[394]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[509]: initializing the server-
              side TLS engine
              Jun 28 15:52:22 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[394]: C4386306820:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[509]: CA58F30682C:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[394]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[394]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[509]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/smtpd[509]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:22 mail1 postfix/cleanup[510]: CA58F30682C: message-
              id=<200706281622.l5SGMilr063020@...>
              Jun 28 15:52:24 mail1 postfix/smtpd[394]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:24 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:24 mail1 postfix/smtpd[509]: D5093306820:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:24 mail1 postfix/smtpd[509]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:24 mail1 postfix/smtpd[509]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:24 mail1 postfix/cleanup[505]: D5093306820: message-
              id=<200706271725.l5RHPCUh004081@...>
              Jun 28 15:52:25 mail1 postfix/smtpd[394]: 5B6CF306820:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:26 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:26 mail1 postfix/smtpd[509]: 15D7630682C:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:26 mail1 postfix/smtpd[509]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:26 mail1 postfix/smtpd[509]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:26 mail1 postfix/cleanup[505]: 15D7630682C: message-
              id=<20070628225226.15D7630682C@...>
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: 20E4330682C:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/cleanup[505]: 20E4330682C: message-
              id=<20070628225227.20E4330682C@...>
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: 9743E30682C:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/smtpd[509]: disconnect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:27 mail1 postfix/cleanup[505]: 9743E30682C: message-
              id=<200706281639.l5SGdoGE065813@...>
              Jun 28 15:52:28 mail1 postfix/smtpd[509]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:28 mail1 postfix/smtpd[511]: initializing the server-
              side TLS engine
              Jun 28 15:52:28 mail1 postfix/smtpd[511]: connect from
              smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:28 mail1 postfix/smtpd[511]: E9FB730682C:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:28 mail1 postfix/smtpd[509]: F2EB9306831:
              client=smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:29 mail1 postfix/smtpd[511]: lost connection after DATA
              from smtp14.redcondor.com[64.84.16.166]
              Jun 28 15:52:29 mail1 postfix/smtpd[511]: disconnect from
              smtp14.redcondor.com[64.84.16.166]


              These are all larger messages. I have looked through the archives
              and setting my MTU down does not seem to resolve the issue. I have
              set the MTU to 1492, so I was wondering if anyone who has resolved
              this issue knows of an MTU sweet spot that I need to move too.

              This client also has a Cisco ASA 5510 that has the latest release of
              the ASA IOS. Port 25 is mapped straight through with a NAT. The
              mail server is on a DMZ, but it looks like a server out on the internet.

              I have the PIX workarounds enabled, but I believe they are only for
              outbound connections (am I wrong) and we seem to have no issues there.


              Thanks,
              Zeke

              --
              James "Zeke" Dehnert
              mailto:jdehnert@...
              Phone: +1 707.546.6620 x602 Fax: +1 707.324.8043
              "Life is racing, everything else is just waiting"
            • Ralf Hildebrandt
              ... Could be anything: * MTU issues * CISCO PIX or other stuff ... Go lower, try 1000 or 1400 ... No, you re right :) ... Since they re sending to you, THEY
              Message 6 of 8 , Jun 29, 2007
                * Dehnert James Sr <jdehnert@...>:
                > I have been seeing these lost connection after DATA messages coming
                > from an upstream connection.
                >
                > brief snippet...
                >
                > Jun 28 15:52:14 mail1 postfix/smtpd[394]: C0727306820: client=smtp14.redcondor.com[64.84.16.166]
                > Jun 28 15:52:14 mail1 postfix/smtpd[394]: lost connection after DATA from smtp14.redcondor.com[64.84.16.166]

                Could be anything:
                * MTU issues
                * CISCO PIX or other stuff

                > These are all larger messages. I have looked through the archives
                > and setting my MTU down does not seem to resolve the issue. I have
                > set the MTU to 1492, so I was wondering if anyone who has resolved
                > this issue knows of an MTU sweet spot that I need to move too.

                Go lower, try 1000 or 1400

                > This client also has a Cisco ASA 5510 that has the latest release of
                > the ASA IOS. Port 25 is mapped straight through with a NAT. The
                > mail server is on a DMZ, but it looks like a server out on the internet.

                > I have the PIX workarounds enabled, but I believe they are only for
                > outbound connections (am I wrong)

                No, you're right :)

                > and we seem to have no issues there.

                Since they're sending to you, THEY must have the PIX workarounds
                enabled.

                --
                Ralf Hildebrandt (Ralf.Hildebrandt@...) plonk@...
                Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155
                http://www.arschkrebs.de
                "Of course, the best way to get accurate information on Usenet is to
                post something wrong and wait for corrections." - Matthew Austern.
              • Dehnert James Sr
                FYI, this was being caused by the Cisco ASA 5500 between the mail server and the rest of the world. The 5500 was set to inspect all esmtp traffic. Once that
                Message 7 of 8 , Jul 31 4:30 PM
                  FYI, this was being caused by the Cisco ASA 5500 between the mail
                  server and the rest of the world. The 5500 was set to inspect all
                  esmtp traffic. Once that ware removes, the stuck mail came flooding
                  through.

                  On Jun 29, 2007, at 12:11 AM, Ralf Hildebrandt wrote:

                  > * Dehnert James Sr <jdehnert@...>:
                  >> I have been seeing these lost connection after DATA messages coming
                  >> from an upstream connection.
                  >>
                  >> brief snippet...
                  >>
                  >> Jun 28 15:52:14 mail1 postfix/smtpd[394]: C0727306820:
                  >> client=smtp14.redcondor.com[64.84.16.166]
                  >> Jun 28 15:52:14 mail1 postfix/smtpd[394]: lost connection after
                  >> DATA from smtp14.redcondor.com[64.84.16.166]
                  >
                  > Could be anything:
                  > * MTU issues
                  > * CISCO PIX or other stuff
                  >
                  >> These are all larger messages. I have looked through the archives
                  >> and setting my MTU down does not seem to resolve the issue. I have
                  >> set the MTU to 1492, so I was wondering if anyone who has resolved
                  >> this issue knows of an MTU sweet spot that I need to move too.
                  >
                  > Go lower, try 1000 or 1400
                  >
                  >> This client also has a Cisco ASA 5510 that has the latest release of
                  >> the ASA IOS. Port 25 is mapped straight through with a NAT. The
                  >> mail server is on a DMZ, but it looks like a server out on the
                  >> internet.
                  >
                  >> I have the PIX workarounds enabled, but I believe they are only for
                  >> outbound connections (am I wrong)
                  >
                  > No, you're right :)
                  >
                  >> and we seem to have no issues there.
                  >
                  > Since they're sending to you, THEY must have the PIX workarounds
                  > enabled.
                  >
                  > --
                  > Ralf Hildebrandt (Ralf.Hildebrandt@...)
                  > plonk@...
                  > Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450
                  > 570-155
                  > http://www.arschkrebs.de
                  > "Of course, the best way to get accurate information on Usenet is to
                  > post something wrong and wait for corrections." - Matthew Austern.
                  >
                  >
                • Ralf Hildebrandt
                  ... Like I said, CISCO malware in the path. -- Ralf Hildebrandt (Ralf.Hildebrandt@charite.de) plonk@charite.de Postfix - Einrichtung, Betrieb und
                  Message 8 of 8 , Aug 1, 2007
                    * Dehnert James Sr <jdehnert@...>:
                    > FYI, this was being caused by the Cisco ASA 5500 between the mail server and
                    > the rest of the world. The 5500 was set to inspect all esmtp traffic. Once
                    > that ware removes, the stuck mail came flooding through.

                    Like I said, CISCO malware in the path.

                    --
                    Ralf Hildebrandt (Ralf.Hildebrandt@...) plonk@...
                    Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155
                    http://www.arschkrebs.de
                    C++ haters point out that even the name of the language contains a
                    bug: "After all, it really should be called ++C, since we only want to
                    use a language after it's been improved."
                    -- Cay Horstmann & Gary Cornell, "Core Java", Sun Press
                  Your message has been successfully submitted and would be delivered to recipients shortly.