421 4.4.1 Connection timed out

ANIL

unread,

Feb 22, 2010, 12:32:34 PM2/22/10

to

Hi to all,

I am using Exchange 2007, when i am getting mails with attachment, some of
the mails are getting timed out. But this does not occur always.

I have disabled chunking and also increase timeout time from 10 minutes to
20 minutes. Also i can receive 5-6 MB mails sometimes without any problem
but i cannot get 800 k of mail as you see from the log below. when i examine
logs all lost mails have SIZE expression near MAIL From:

,<,MAIL From:<bra...@certme.com> SIZE=842594,

THANKS.

RECEIVE CONNECTOR LOGS:

#Software: Microsoft Exchange Server
#Version: 8.0.0.0
#Log-type: SMTP Receive Protocol Log
#Date: 2010-02-22T00:35:02.199Z
#Fields:
date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context
2010-02-22T02:57:32.211Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,0,192.168.10.5:25,195.125.160.5:52588,+,,
2010-02-22T02:57:32.211Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,1,192.168.10.5:25,195.125.160.5:52588,*,SMTPSubmit
SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender
AcceptRoutingHeaders,Set Session Permissions
2010-02-22T02:57:32.211Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,2,192.168.10.5:25,195.125.160.5:52588,>,"220
CTLMAIL01.ctl.local Microsoft ESMTP MAIL Service ready at Mon, 22 Feb 2010
04:57:31 +0200",
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,3,192.168.10.5:25,195.125.160.5:52588,<,EHLO
david.trebem.com,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,4,192.168.10.5:25,195.125.160.5:52588,>,250-CTLMAIL01.ctl.local
Hello [195.125.160.5],
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,5,192.168.10.5:25,195.125.160.5:52588,>,250-SIZE,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,6,192.168.10.5:25,195.125.160.5:52588,>,250-PIPELINING,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,7,192.168.10.5:25,195.125.160.5:52588,>,250-DSN,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,8,192.168.10.5:25,195.125.160.5:52588,>,250-ENHANCEDSTATUSCODES,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,9,192.168.10.5:25,195.125.160.5:52588,>,250-STARTTLS,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,10,192.168.10.5:25,195.125.160.5:52588,>,250-X-ANONYMOUSTLS,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,11,192.168.10.5:25,195.125.160.5:52588,>,250-AUTH
LOGIN,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,12,192.168.10.5:25,195.125.160.5:52588,>,250-X-EXPS
GSSAPI NTLM,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,13,192.168.10.5:25,195.125.160.5:52588,>,250-8BITMIME,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,14,192.168.10.5:25,195.125.160.5:52588,>,250-XEXCH50,
2010-02-22T02:57:32.398Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,15,192.168.10.5:25,195.125.160.5:52588,>,250
XRDST,
2010-02-22T02:57:32.585Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,16,192.168.10.5:25,195.125.160.5:52588,<,MAIL
From:<bra...@certme.com> SIZE=842594,
2010-02-22T02:57:32.585Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,17,192.168.10.5:25,195.125.160.5:52588,*,08BB4878E631167F;2010-02-22T02:57:32.211Z;1,receiving
message
2010-02-22T02:57:32.585Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,18,192.168.10.5:25,195.125.160.5:52588,>,250
2.1.0 Sender OK,
2010-02-22T02:57:32.772Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,19,192.168.10.5:25,195.125.160.5:52588,<,RCPT
To:<umu...@ctl.com>,
2010-02-22T02:57:32.772Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,20,192.168.10.5:25,195.125.160.5:52588,>,250
2.1.5 Recipient OK,
2010-02-22T02:57:32.772Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,21,192.168.10.5:25,195.125.160.5:52588,<,DATA,
2010-02-22T02:57:32.772Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,22,192.168.10.5:25,195.125.160.5:52588,>,354
Start mail input; end with <CRLF>.<CRLF>,
2010-02-22T03:06:26.778Z,CTLMAIL01.
.
.
.
.
.
.
.
.
.
2010-02-22T03:07:21.213Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E631167F,23,192.168.10.5:25,195.125.160.5:52588,-,,Remote

2010-02-22T03:59:46.472Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,0,192.168.10.5:25,195.125.160.5:57019,+,,
2010-02-22T03:59:46.472Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,1,192.168.10.5:25,195.125.160.5:57019,*,SMTPSubmit
SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender
AcceptRoutingHeaders,Set Session Permissions
2010-02-22T03:59:46.472Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,2,192.168.10.5:25,195.125.160.5:57019,>,"220
CTLMAIL01.ctl.local Microsoft ESMTP MAIL Service ready at Mon, 22 Feb 2010
05:59:46 +0200",
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,3,192.168.10.5:25,195.125.160.5:57019,<,EHLO
david.trebem.com,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,4,192.168.10.5:25,195.125.160.5:57019,>,250-CTLMAIL01.ctl.local
Hello [195.125.160.5],
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,5,192.168.10.5:25,195.125.160.5:57019,>,250-SIZE,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,6,192.168.10.5:25,195.125.160.5:57019,>,250-PIPELINING,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,7,192.168.10.5:25,195.125.160.5:57019,>,250-DSN,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,8,192.168.10.5:25,195.125.160.5:57019,>,250-ENHANCEDSTATUSCODES,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,9,192.168.10.5:25,195.125.160.5:57019,>,250-STARTTLS,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,10,192.168.10.5:25,195.125.160.5:57019,>,250-X-ANONYMOUSTLS,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,11,192.168.10.5:25,195.125.160.5:57019,>,250-AUTH
LOGIN,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,12,192.168.10.5:25,195.125.160.5:57019,>,250-X-EXPS
GSSAPI NTLM,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,13,192.168.10.5:25,195.125.160.5:57019,>,250-8BITMIME,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,14,192.168.10.5:25,195.125.160.5:57019,>,250-XEXCH50,
2010-02-22T03:59:46.675Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,15,192.168.10.5:25,195.125.160.5:57019,>,250
XRDST,
2010-02-22T03:59:46.862Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,16,192.168.10.5:25,195.125.160.5:57019,<,MAIL
From:<bra...@certme.com> SIZE=842594,
2010-02-22T03:59:46.862Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,17,192.168.10.5:25,195.125.160.5:57019,*,08BB4878E6311681;2010-02-22T03:59:46.472Z;1,receiving
message
2010-02-22T03:59:46.862Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,18,192.168.10.5:25,195.125.160.5:57019,>,250
2.1.0 Sender OK,
2010-02-22T03:59:47.065Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,19,192.168.10.5:25,195.125.160.5:57019,<,RCPT
To:<umu...@ctl.com>,
2010-02-22T03:59:47.065Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,20,192.168.10.5:25,195.125.160.5:57019,>,250
2.1.5 Recipient OK,
2010-02-22T03:59:47.065Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,21,192.168.10.5:25,195.125.160.5:57019,<,DATA,
2010-02-22T03:59:47.065Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,22,192.168.10.5:25,195.125.160.5:57019,>,354
Start mail input; end with <CRLF>.<CRLF>,
.
.
.
.
.
.
.
.
.
.
2010-02-22T04:19:58.602Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,23,192.168.10.5:25,195.125.160.5:57019,>,421
4.4.1 Connection timed out,
2010-02-22T04:19:58.602Z,CTLMAIL01\Default
CTLMAIL01,08BB4878E6311681,24,192.168.10.5:25,195.125.160.5:57019,-,,Local

__________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4887 (20100222) __________

ï¿½leti ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan denetlendi.

http://www.nod32.com.tr

Ed Crowley [MVP]

unread,

Feb 22, 2010, 3:17:24 PM2/22/10

to

Do you have anything between the Internet and your Exchange server, such as
a firewall or router that is configured to help you by filtering SMTP in any
way?
--
Ed Crowley MVP
"There are seldom good technological solutions to behavioral problems."
.

"ANIL" <an...@noemail.noemail> wrote in message
news:E4E4AF96-7189-45F6...@microsoft.com...

ANIL

unread,

Feb 23, 2010, 2:54:43 AM2/23/10

to

i have a firewall but that is not configured to filter SMTP and if that is
because of firewall why some attachments pass through and some not. for
example if i send which the mail in the logs below from an other mail
account that comes without any problem.

Thanks

"Ed Crowley [MVP]" <curs...@nospam.net>, iletisinde ï¿½unu yazdï¿½,
news:umSpKw$sKHA...@TK2MSFTNGP04.phx.gbl...

> bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4888 (20100222) __________

>
> ï¿½leti ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan denetlendi.
>
> http://www.nod32.com.tr
>
>
>

__________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4888 (20100222) __________

James Luo

unread,

Feb 23, 2010, 3:33:58 AM2/23/10

to

Please try to find the pattern of the problem, for instance, whether it's
only happen to internal mail flow, incoming mail flow, or outgoing mail
flow?
Please telnet exchange server, and then compare the time on the banner with
the local server time. The time must be the same (Also apply for host
machine if it's a virtualization environment)
You may use Network Monitor to capture the traffic, and analyze the cause

ANIL

unread,

Feb 23, 2010, 10:50:23 AM2/23/10

to

Hi,

Thanks for reply, the problem only happens at incoming mail flow. theri is
not any problem at internal mails or outgoing mails.
Which type of filter can i use when capturing traffic when using Network
Monitor

Thanks.

ANIL

"James Luo" <v-jaluo@microsoft>, iletisinde ï¿½unu yazdï¿½,
news:%23dhz0LG...@TK2MSFTNGHUB02.phx.gbl...

> __________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan

> bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4888 (20100222) __________

>
> ï¿½leti ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan denetlendi.
>
> http://www.nod32.com.tr
>
>
>

__________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4890 (20100223) __________

ANIL

unread,

Feb 23, 2010, 10:53:25 AM2/23/10

to

Hi,

Thanks for reply, the problem only happens at incoming mail flow. theri is
not any problem at internal mails or outgoing mails.
Which type of filter can i use when capturing traffic when using Network
Monitor

Thanks.

ANIL

"James Luo" <v-jaluo@microsoft>, iletisinde ï¿½unu yazdï¿½,
news:%23dhz0LG...@TK2MSFTNGHUB02.phx.gbl...

> __________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan

> bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4888 (20100222) __________

>
> ï¿½leti ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan denetlendi.
>
> http://www.nod32.com.tr
>
>
>

__________ ESET NOD32 Antivirus Akï¿½llï¿½ Gï¿½venlik tarafï¿½ndan saï¿½lanan bilgiler, virï¿½s imza veritabanï¿½ sï¿½rï¿½mï¿½: 4890 (20100223) __________