From: dogbert (no email)
Date: Thu Dec 01 2005 - 11:12:04 EST
Wietse Venema wrote:
> Wietse:
>>> To diagnose the problem you will need to record a failed session
>>> with, for example tcpdump. Record the full packet content:
>>>
>>> tcpdump -s 2000 -i interface -w /file/name
>>>
>>> There has been a recent flurry of "timeout after DATA" problems
>>> with MS Exchange 5 because it was sending mail that did not end in
>>> "<CR><LF>.<CR><LF>".
>
> dogbert:
>> I've analyzed some sessions with Ethereal and found that the main difference
>> between a working mail (that pass through postifx) and a bad message (that
>> stuck) is that the latter doesn't terminate with a \r\n.\r\n but with a packet
>> of EOM (if I decode with ethereal the full SMTP transmission it contain the last
>> . for ending the session but it is not present in the MESSAGE BODY part of the
>> session).
>
> What is EOM?
>
> Can I see the data that is actually sent? I hate it when helpful
> software changes the evidence.
>
> If the mail does not end in "<CR><LF>.<CR><LF>" then it does
> not comply with the SMTP protocol, and all bets are off.
>
> Wietse
>
I believe that EOM stand for End Of Message and I hope that if Ethereal can
understand is as part of an SMTP transaction it somehow comply with smtp standard.
Here is what Ethereal decode of the transaction:
------------------------------------------------
220 mailfilter.testdomain.it
EHLO mail1.testdomain.it
250-mailfilter.testdomain.it
250-SIZE 1000000000
250-VRFY
250-ETRN
250 8BITMIME
MAIL FROM: <> SIZE=757
250 Ok
RCPT TO: <>
250 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
X-SEF-Processed: 5_0_0_713__2005_12_01_17_01_52
X-SEF-AE0723B2-1DB9-4A10-B06E-C6DC66A014F9: 1
Received: from Unknown [172.28.253.1] by mail1.testdomain.it - SurfControl
E-mail Filter (5.0); gio, 01 dic 2005 17:01:52 +0100
Message-ID: <438F1E70 dot 1060608 at tiscali dot it>
Date: Thu, 01 Dec 2005 17:01:52 +0100
From: dogbert <>
User-Agent: Thunderbird 1.5 (Windows/20051025)
MIME-Version: 1.0
To:
Subject: test message
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
this is a test message.
.
------------------------------------------------
the last dot is the <CR><LF>.<CR><LF> but I'm going to make a tcpdump of the
session if you prefer it as it is (without decoding).
|
|
|