Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Has something changed? Possible bug?
  FAQ FAQ  Forum Search   Register Register  Login Login

Has something changed? Possible bug?

 Post Reply Post Reply
Author
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Topic: Has something changed? Possible bug?
    Posted: 14 September 2005 at 3:27am

Hi please help me out!

When someone sends a e-mail to me and the message exceeds the limit no NDR is generated. So the senders server keeps tryieng to send the message to my spamfilter server. Is this new? I think i remember that if a message is too big SF sends a NDR?

This is my settings in sf ini.

MaxIncomingMsgSize=50000

DoNotSendNDROnQuarantine=1

I understand it this way. SF should not send NDR if the mail is put in the QDB. (So no ndr on spam). But mail exceeding max message size isn't put in the QDB, so SF should send a NDR to the sending server, so that it would not try to resend it?

My prolem is that SF doesen't send a NDR if the message exceeds max limit. So sending servers are trying to resend the message again and again (as they are supposed to) because they don't get a NDR.

Please ask me if there's something im uncleaer about, or if You don't understand my problem.

BTW: Running SF 2.6.3.483 registered on a Windows 2003 server.

Best regards...

Torsten Christiansen aka. SirRar



Edited by sirrar
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 14 September 2005 at 8:35am
Sirrar,

You are correct, we were able to replicate the problem. Definetly a bug. When the message size limit is reached, for some reason SpamFilter is disconnecting the sender abruptly without outputting an error code. This may cause the sender to retry sending the message multiple times.

We're working on a fix right now, and will make it available as soon as possible (hopefully hours, not days).
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
_Eric View Drop Down
Newbie
Newbie


Joined: 13 May 2005
Location: Netherlands
Status: Offline
Points: 14
Post Options Post Options   Thanks (0) Thanks(0)   Quote _Eric Quote  Post ReplyReply Direct Link To This Post Posted: 14 September 2005 at 4:50pm
yes! i notice also in my mrtg,
using SpamFilter ISP v2.5.2.458 (registered)
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 14 September 2005 at 7:53pm
Sirrar, Eric,

We've uploaded pre-release build 2.6.3.485 in the registered user area. This build contians the fix for the problem Sirrar reported. Please note that as usual, pre-release builds are not fully tested, but are released to make immediately available patches and enhancements as soon as possible to users.

The release notes for this build are as follows:

// New to VersionNumber = '2.6.3.485';
{TODO -cFix : When emails were over the MaxMsgSize limit, the sender was sometimes disconnected without outputting a numeric error code, causing them to retry }
{TODO -cNew : Added more logging for the IP-to-Country lookup exception error handling routines}


Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 9:11am

Hi again

 

Thanks for the quick response.

Just impelmented 485.  Within a few hours I will se if it has helped. And report back.

Thanks in advance.

 

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 1:05pm

Hi again.

 

Nope I'm not convinced that is has helped.

Too large e-mails are still being resend again and again.

 

Best regards.

SirRar

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 2:36pm
Torsten,

We double-checked internally and on our own ISP, and so far the fix appears to work fine. We'll be testing your install remotely shortly.


Edited by LogSat
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 3:01pm

Hi again

It's at the moment 50 MB (50000 KB).

But we could try to coordinate a smaller size for test.

I will from now on and about 12 hours from now have it set to 5000 kb (5 MB) (for test purpose).

I have several mail tryieng to be send at me right now....

http://www.sirrar.dk/mrtg/192.168.1.1_1.html

best regards

Torsten Christiansen

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 3:07pm

As You can se on my MRTG several prople has since tuesday been tryieng to send me some large e-mails (all exceeding 50 MB).

And they keep tryeing (not the user, but the sending server)

The sending server is one of Denmarks most respected ISP's. Teledanmark (TDC). I'm quite confident that they'r servers are OK.

Also don't see anything in my mail logs that indicates that SF is sending something to the seing server.

I could reply on your test message and attach my mail log

then You could se for yourself?

 

Best regards...

Torsten

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 3:10pm

I gotta be away from the next 10 hours...

Maxlimit is 5 MB (5000)

 

best regards

Torsten Christiansen

Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 16 September 2005 at 3:34pm
Torsten,

We duplicated the problem remotely on your install. You're correct, it's still not fixed. We'll need to troubleshoot this a bit further, as right now I really can't tell what the problem is .

We'll post a fix as soon as we find it.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 17 September 2005 at 2:29am

Hi again OK

I will post some additionel info in reply to your test e-mail yesterday.

I have noticed a little difference between versions prior to 485. With 485 the time from SF have concluded that the e-mail exceeds max limit to the disconnect takes several minutes now. But You will se that in the additional info i will send you (i alo include my ini file)

 

Best regards

Torsten



Edited by sirrar
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 18 September 2005 at 11:41pm
Torsten,

The issue was the following. Prior to build 485, SpamFilter was continuosly monitoring the size of the incoming emails. As soon as the limit was reached, SpamFilter was sending the remote server an error message notifying of the size restriction, then was immediately disconnecting them as to avoid the unnecessary reception of the remainder of the email. If the max msg size was 10MB for example, and the email size was 200MB, this resulted in great savings of resources and bandwidth.

However you poointed out a problem we were not aware of. Under certain cirumstances, the remote server would not "listen" for SpamFilter's error message, and would continue sending the email body uninterrupted. When SpamFilter forced a disconnect, without receiving the error message, the sender assumed there was a connection problem and retried to send it.

With build 485 we thus increased greatly the time delay between when SpamFilter sent the error message and the time at which SpamFilter disconnected the sender. However again you (and we duplicated it) found circumstances in which the sender was being very *hardhead* and would not listen for a return code until it had completely finished sending the *whole* email.

Unfortunately the only solution in this case has been for SpamFilter to completely receive the *whole* email, as only then would the stubborn sender listen and look for an error response. We tried to make the receiving piece as less resource-intensive as possible, eliminating all (now unnecessary as the email will be discarded) decoding and RFC processing, but again have been forced to receive the full email before disconnecting the sender. This will result in a waste of bandwidth and (limited) resources, but so far appears to be the only fully reliable way to prevent the sender to keep retrying to send the message.

The build with this fix is 487, now avail in the registered user area.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
sirrar View Drop Down
Groupie
Groupie
Avatar

Joined: 26 January 2005
Location: Denmark
Status: Offline
Points: 44
Post Options Post Options   Thanks (0) Thanks(0)   Quote sirrar Quote  Post ReplyReply Direct Link To This Post Posted: 19 September 2005 at 12:52am

Hi again Robert

Thankyou very much.

Just implemented 487. And now, as You said, a NDR is generated so that sending servers only tries to send the e-mail once.

A pitty your idea woulden't work allways. It was a good idea, unfortunatly it had an effect to assume a lot much bandwith...

Thanks again for fixing this issue!



Edited by sirrar
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.328 seconds.