On Tue, 23 Jul 2002 at 10:11:31 +0200, Lars Roland Kristiansen wrote: > On Tue, 23 Jul 2002, Vineet Kumar wrote: > [...] > > This doesn't look particularly harmful, but if it is the "unknown" part > > that is scaring you, try adding an entry for 192.168.2.1 in /etc/hosts. > > Other than that, it just looks like that host is making an smtp > > connection and then later disconnecting. This will happen each time it > > relays a message through you, and is nothing to be alarmed about (unless > > you don't intend to be accepting mail from this host, but as I > > understood your setup, that's exactly what you intend to be doing). > > Well maby you are right it is only a littel strange that when it ralays a > mail it says somthing like this. > > Jul 23 10:10:12 mail > postfix/cleanup[7634]: 1B8CC43C024: message-id=<[EMAIL PROTECTED]> > Jul 23 10:10:12 mail > postfix/qmgr[284]: 1B8CC43C024: from=<[EMAIL PROTECTED]>, size=794, > nrcpt=1 (queue active) > Jul 23 10:10:12 mail postfix/smtpd[7633]: disconnect from > unknown[192.168.2.1] > Jul 23 10:10:13 mail > postfix/smtp[7636]: 1B8CC43C024: to=<[EMAIL PROTECTED]>, > relay=imf.math.ku.dk[130.225.103.32], delay=1, status=sent (250 2.0.0 > g6N89Qx26308 Message accepted for delivery) > > So if this is when it is duing somthing what is the rest and is there a > way to track it down. >
If I understand you correctly, you wonder what goes on when this host connects and later disconnects _without_ sending anything. You can have more details in log about this host's activity if you add to main.cf: debug_peer_list = 192.168.2.1 and possibly: debug_peer_level = 2 (or maybe bigger number - I don't know what range of numbers is accepted by this parameter). Hope it helps -- Tomasz Papszun SysAdm @ TP S.A. Lodz, Poland | And it's only [EMAIL PROTECTED] http://www.lodz.tpsa.pl/ | ones and zeros. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
