up vote 0 down vote favorite
share [g+] share [fb]

I've been using port 2525 as an alternative mail port for quite some time now with few problems, however, it's always thrown a nagios alert from time to time that the service is unavailable, by the time I log in or even try to telnet to the port there are no issues, nothing in the logs and no other indications of any other problem. Once in a while I will try to send mail via that port and I will get a server unavailable, retry and it's fine.

I'm just wondering if something else could be blocking./trying that port? or if it has a limit set somewhere else - other than xinetd.

  • xinet limits are 100 connections, which should be tons and tons for the number of users actually using it [maybe a dozen]
  • I limited proftpd to use unpriviledged ports higher than that just in case ftp users were monopolizing the port... does not appear to be the case.
  • scanned for trojans etc, nadda

kinda stumped on this one as from time to time I will get a mail user complain and describe the same symptons I see... I have the same nagios monitor on port 25 & 26, they never alert, just 2525..

-stumped! -sean

link|improve this question
58% accept rate
I think I may have found the problem..... I think the spam RBL service has a max number opf connections from a given host [I'm using the free service plan] – Sean Kimball Apr 23 '11 at 20:34
feedback

1 Answer

up vote 1 down vote

I'd run a packet trace on the server, something like 

tcpdump -i eth0 -w /path/to/savefile dst port 2525 and tcp[13]==2

That will capture all syn packets sent to port 2525 on the server. You can then parse those with the "-r" option to tcpdump.

Alternately, you could use an iptables rule to do the same thing:

iptables -A INPUT -p tcp -dport 2525 --tcp-flags SYN,ACK SYN -j LOG \
--log-prefix="mail_traffic"

which will log any packets with the syn flag set, but not the ACK coming in on that port.

You can then use that data to correlate with your nagios alerts, and possibly find out what's causing it.

link|improve this answer
thanks, I tinkered with this a little this morning, left it running in the back ground, we'll see I guess. thing is it seems to show me the incoming connections - ok, fine. but not really what is happeneing... ? also - maybe an important tidbit I left out, this is a virtual machine, sometimes those virtual adapters can do odd things, maybe that is an issue? – Sean Kimball Apr 8 '11 at 14:18
I limited it to incoming connections intentionally - that's a first pass to see if someone is scanning you, or making a ton of connections for some other reason. It could very well be that it's your virtual adapter - or some other reason. Gathering more data is the first step. If it's an adapter issue on a VM, I'd start looking at logs on the VM, and also on the host machine, and see if anything correlates to the times you see the nagios alerts. – malcolmpdx Apr 8 '11 at 14:29
yea - I've been up and down the logs many-many times, [been going on for a couple years] nothing interesting in any of them... unfortunately I don;t have access to the host logs. - I guess we'll see what this first pas has to say . – Sean Kimball Apr 8 '11 at 14:45
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.