Mail7 11.15.2007

[Infinitation]

It appears so. This is going on two days. Can we divert this mail traffic temporarily?

[WalkerL55]

Is it possible to switch my clients from mail7 to another mail server my self? if so, how can i accomplish that. Clients have been down for 1.5 to 2 days now, just looking for a solution to get them up and running while you guys are hard at work on mail7.

Nothing is down, port 25 is blocking all Windows clients. Please use 2525. Other than that everything is ok.

If you still have a problem run a a traceroute, (tracert on windows).

If you cant reach the box, your blocked. If you can reach it try and telnet to port 2525. If you dont see a banner there is a legitimate problem (which our nagios detects within 30 seconds).

[ajpetras]

port 2525 is not responding to my telnet request and it is not connecting through our outlook either.
Inbound seems to be OK now.

[ajpetras]

I can tracert to it and it works fine, but the telnet sessions does not connect

[ajpetras]

OK got it working now.
Sorry bad config on our router, wasnt letting port 2525 through unconditionally

thanks.

[bkogan]

Originally Posted by aaron

You can click the account ID, then click mail info from the CP.

Hi Aaron,
I think that still forces us to look thru each account one at a time which is very time consuming.

The question is (and I am also wondering) if there is a 'mail server' report in H-Sphere OR some way of creating custom reports?

Or you can ping mail.domain.com and note the IP address. They follow standard form .20 = mail 0 .27 = mail7 etc

[Brangwyn]

Nothing is down, port 25 is blocking all Windows clients

I'm Curious how your determining what's a windows cilent and what's not Aaron?

Passive OS fingerprinting.

See http://www.openbsd.org/faq/pf/ for details, specifically http://www.openbsd.org/cgi-bin/man.c...86&format=html

[mresell]

Don't want to hijack and may be totally unrelated, but I have started getting a ton of spam the past several days. Not on those mail servers tho. Multiples of similiar type emails from same sources it seems, due to the consistent profile. Is alot of this abuse coming from actual email volume?

Yes, an insane amount of volume. As I said earlier I was watching the packetfilter track 50,000 connections to one host alone!

Note that the tcp established timeout at this time was 20 seconds... bad bad botnets

[WalkerL55]

Has this issue with mail7 been resolved?

It appeared to fine last night , then this morning i am getting client calls about the same issue. I even have them on port 2525.

Will i need to give you the main ip from their router ect.?

WalkerL55

[uecs]

The problem is in no way resolved, often times the server doesn't answer on port 2525 for users sending messages and many messages NEVER arrive incoming (monitoring through webmail or to the clients directly), I have multiple clients threatening service termination TODAY if it's not resolved due to this being a multi-day problem and when I call the support number nobody is there, I put tickets in and you guys respond with "change the port to 2525"... not going to help, need resolution ASAP.

The above post is totally bogus. There is nothing wrong with mail7. Tickets are being answered etc.

In the time it took you to go on a rant you could have provided a traceroute and a telnet to port 25 result, which in turn would indentify the ''problem'' which is probably your local Internet security program blocking 2525 or something else.

Here are two of those from 10:47AM

From a good connection
aaron@yoda:~> traceroute mail7.hsphere.cc ; telnet mail7.hsphere.cc 25
traceroute to mail7.hsphere.cc (216.157.145.27), 64 hops max, 40 byte packets
1 66.103.146.65 (66.103.146.65) 0.478 ms 0.466 ms 0.443 ms
2 66.103.132.177 (66.103.132.177) 0.459 ms 0.505 ms 0.432 ms
3 f0-1.na01.b006686-0.mco01.atlas.cogentco.com (38.112.1.193) 1.310 ms 0.873 ms 0.689 ms
4 RapidColo.demarc.cogentco.com (38.112.14.122) 0.967 ms 0.980 ms 0.945 ms
5 barney.rapidcolo.com (216.81.79.9) 0.972 ms 1.049 ms 1.511 ms
6 mail7.hsphere.cc (216.157.145.27) 1.204 ms 1.086 ms 1.317 ms
Trying 216.157.145.27...
Connected to mail7.hsphere.cc.
Escape character is '^]'.
220 mail7.hsphere.cc ESMTP

From my home

[root@jedi]# traceroute mail7.hsphere.cc ; telnet mail7.hsphere.cc 25
traceroute to mail7.hsphere.cc (216.157.145.27), 64 hops max, 40 byte packets
1 * * *
2 gig5-0-0.orldflwrpk-rtr1.cfl.rr.com (24.95.228.81) 7.547 ms 7.412 ms 7.814 ms
3 145.228.95.24.cfl.res.rr.com (24.95.228.145) 8.758 ms 8.336 ms 7.794 ms
4 so-7-1.car2.Orlando1.Level3.net (4.79.118.41) 8.263 ms 8.764 ms 7.951 ms
5 ae-11-11.car1.Orlando1.Level3.net (4.69.133.73) 189.300 ms 192.427 ms 203.584 ms
6 * * *
7 ae-1-55.bbr1.Atlanta1.Level3.net (4.68.103.129) 18.233 ms
ae-1-51.bbr1.Atlanta1.Level3.net (4.68.103.1) 23.467 ms
ae-1-53.bbr1.Atlanta1.Level3.net (4.68.103.65) 17.152 ms
8 so-1-0-0.mp1.Orlando1.Level3.net (64.159.0.29) 26.297 ms 24.684 ms 25.905 ms
9 ge-10-2.hsa1.Orlando1.Level3.net (209.247.11.38) 24.291 ms
ge-10-0.hsa1.Orlando1.Level3.net (64.159.0.34) 25.376 ms 24.854 ms
10 VORTECH.hsa1.Orlando1.Level3.net (4.79.116.130) 26.834 ms 43.441 ms 27.756 ms
11 barney.rapidcolo.com (216.81.79.9) 27.124 ms 29.607 ms 29.266 ms
12 mail7.hsphere.cc (216.157.145.27) 31.037 ms 30.009 ms 31.970 ms
Trying 216.157.145.27...
Connected to mail7.hsphere.cc.
Escape character is '^]'.
220 mail7.hsphere.cc ESMTP