4

We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail appears to be getting through the Watchguard box, but it is not showing up on the Barracuda box. I've been on the phone with techs from both companies and they both pretty much point the finger at the other box.

To help narrow down the problem, I'm going to hook up the outgoing port of the Watchguard box to a hub and connect my laptop, which is running Wireshark. My question is: what packets will I see that will tell me whether mail is getting through the Wireshark box? Can anyone recommend what filter I should use, or at least tell me what types of packets (e.g. will they show up as SMTP?). Or maybe I should just look for traffic on port 25? Thanks in advance.

4 Answers 4

9

Step 1 is to start grabbing packets in front of the spam appliance, where it theoretically receives them after passing the firewall. You want to set your capture filter to "port 25". Wireshark's dissector is good enough to do most of the analysis its self. Right-click on a packet, select "View TCP session" to get a complete transcript of a SMTP session.

If you see no packets, then your firewall really isn't passing SMTP traffic. You may want to send a few messages yourself to prove your capture filter is working. Repeat the test in front of your firewall if possible to prove you're getting any at all.

If all you see are SYN packets to the appliance with no response, then you've found your culprit. The appliance has gone on vacation.

If you see full SMTP conversations that look normal, repeat the test on the outbound port of your appliance.

If the outbound port shows no SMTP traffic, then you know the problem is inside the appliance somewhere. This should help convince vendor support that it really is their problem.

If you see complete traffic outbound, then the problem is in your mail system somewhere.

0
3

How about the wireshark wiki on SMTP? And here is a blog post for beginners.

1

Couple other options...

1) You could always try manual telnet tests to port 25 on the outside and go through the SMTP conversation manually. Details here: http://support.microsoft.com/kb/153119

2) I'm not familiar with barracuda boxes but on most linux email gateways, you can just run tcpdump (something like tcpdump port 25 -s 0 -w foo.pcap).

-M

0

I'd try plugging in between the Firewall and the spam filter. If you're not capturing anything, do your approach.

Well, I'd grab all packets on port 25 and then inspect, that way you're sure not to miss anything due to wrong filters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .