[Snort-users] Packet loss
mkettler at ...4108...
Mon Nov 29 08:38:06 EST 2004
At 07:58 PM 11/27/2004, Michael Steele wrote:
>I've checked everything here and nothing on my end is being sent only
That was very definitively a SF problem. If you look at the headers you can
see that the multiplication was done by sc8-sf-list1-b.sourceforge.net
while passing it to another SF.net server. This server accepted one message
from,but redelivered it many times to sc8-sf-spam2.sourceforge.net.
You can tell by the SMTP transfer IDs and timestamps in the Received: headers.
sc8-sf-list1 received it from sc8-sf-mx2-b under transfer id 1CXyNf-0007Nm-Pc.
sc8-sf-list1delivered it to sc8-sf-spam1 durring transfer id's
1CY0mP-0008UP-U2, 1CY0iY-0008Af-Ia, 1CXybd-0005OP-Ce.....
100% inside sf.net. Could have been some kind of bug where spam1 was
emitting a SMTP 4xx temporary failure, but still delivering the message
anyway. Or it could have been list1's failure to recognize the SMTP 2xx
acceptance message and timing out.
I've seen a lot of sites lately suffering from the bug with 4xx errors.
Gotten several complaints from users at "household name" companies claiming
I've sent them several copies of a message, only to find that their site
explicitly issued a 4xx error to my MX, but apparently delivered the
message anyway. Apparently SF.net is using the same buggy software they are...
More information about the Snort-users