Re: ipf rules preventing smtp traffic with ATT mailservers

[Carson Gaspar <carson@taltos.org>]

Paul Theodoropoulos wrote:
> At 12:53 PM 6/1/2007, you wrote:
> > Question in terms of list etiquette - rather than posting a huge 
> > packet dump to the list, is it acceptable to post the file on my 
> > website, and provide a link to it? Possibly more importantly - is 
> > doing so desireable?
> In advance of a response, I have posted the snoop output to my website, 
> plaintext. I'll be happy to post it to the list if that's also desired.
> http://www.anastrophe.com/snoop-out
>
> The only change I've made is to elide the recipient's address from the 
> output.
And the associated ipf logs? Right now, it looks like one of the ACKs 
from the SMTP server is being blocked (but your snoop has no timestamps, 
so it's hard to be sure). Window scaling is being negotiated for this 
connection. Try disabling window scaling on your server and see if that 
fixes things. If so, you're either running an older ipf code base, or 
Darren still has window scaling bugs to fix.
--
Carson