Outbound OK, inbound timeout errors   

Our mailserver connects to a third party barracuda device. They receive all 
our mail and also are a pass-through on our mail delivery. Outbound mail is 
delivered fine, but when their machine attempts to connect to us for inbound, 
the connections sometimes time out (ACK, SYN timeout) after :30 seconds.

I have gone over the firewall settings and there is nothing that is 
preventing this. All was working 100% until last Friday. Over the weekend all 
was well, then Monday it started again around 10 am local. It stopped at 
around 6 pm. All regular internet traffic is smooth, no hickups (7 T1's).

I think it's a DoS attack on port 25, but I may be incorrect. The times that 
the attack are happening coincide with business hours. What can I check 
within Exchange to make sure it's not Exchange causing this problem? I have 
run a packet monitor, and it shows connections are flowing, but I didn't do 
this till after 6pm. I have over 100 users receiving email, and it's causing 
problems. We can't have our network down.
-- 
Anthony

date: Mon, 25 Feb 2008 18:47:00 -0800   author:   Anthony

Re: Outbound OK, inbound timeout errors   

Download Exchange Troubleshooting Assistant,

http://technet.microsoft.com/en-us/exchange/bb288481.aspx

Verify the Barracuda Logs to insure its not the cause.

-- 
John Oliver, Jr
MCSE, MCT, CCNA
Exchange MVP 2008
Microsoft Certified Partner


"Anthony"  wrote in message 
news:5E176347-EA0A-4540-B2CB-FB5AFAD63A47@microsoft.com...
> Our mailserver connects to a third party barracuda device. They receive 
> all
> our mail and also are a pass-through on our mail delivery. Outbound mail 
> is
> delivered fine, but when their machine attempts to connect to us for 
> inbound,
> the connections sometimes time out (ACK, SYN timeout) after :30 seconds.
>
> I have gone over the firewall settings and there is nothing that is
> preventing this. All was working 100% until last Friday. Over the weekend 
> all
> was well, then Monday it started again around 10 am local. It stopped at
> around 6 pm. All regular internet traffic is smooth, no hickups (7 T1's).
>
> I think it's a DoS attack on port 25, but I may be incorrect. The times 
> that
> the attack are happening coincide with business hours. What can I check
> within Exchange to make sure it's not Exchange causing this problem? I 
> have
> run a packet monitor, and it shows connections are flowing, but I didn't 
> do
> this till after 6pm. I have over 100 users receiving email, and it's 
> causing
> problems. We can't have our network down.
> -- 
> Anthony

date: Tue, 26 Feb 2008 19:16:01 -0500   author:   John Oliver, Jr. [MVP]