• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1174
  • Last Modified:

POP TLS connection stalls when AVG mail scanner running

Request: Can anyone help me setup my AVG email scanner to work with Thunderbird accessing an email account that uses TLS?

OS - Windows Vista Ultimate
Anti-virus: AVG Free 8.5.325
Email Client: Mozilla Thunderbird
Email sever: Zimbra POP3 server - over which I have very little control, but if someone can tell me any setting that need to be adjusted on the server I can submit a request.

Problem: I  installed AVG Free three days ago.  Since then I have noticed that one of my email accounts has not being receiving mail - this particular account negotiates a TLS connection and have realised that since installing AVG, the email client connects to the server but never gets past the TLS connection.  Eventually (after 600 seconds) the TCP connection dies.  If I turn off the email scanner options in AVG free, the mail client connects normally and terminates normally (after downloading mail if any)
Below are two TShark dumps, with the mail server IP replaced by x.x.x.180.  The first examples shows a successful connection with the email scanner activated.  The second shows the same connection WITH the email scanner de-activated.

Additional Information:
Thunderbird server settings:
Server Type: POP Mail server
Server name: mail.x.x.x.com Port 110
User Name: me@x.x.x.com
Security Settings: Use Secure connection TLS, if available
Use Secure authentication:- NOT selected
Server settings: No sever settings selected

Thunderbird Security settings:
No certificates or Encryption options selected.

With AVG Email scanner active: (Note 600 seconds of inactivity after packet 8)
  0.000000 -> x.x.x.180 TCP 49460 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1260 WS=2 TSV=17385299 TSER=0
  0.256385  x.x.x.180 -> TCP 110 > 49460 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1452 TSV=3514443520 TSER=17385299 WS=7
  0.256488 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=1 Ack=1 Win=17472 Len=0 TSV=17385325 TSER=3514443520
  0.512457  x.x.x.180 -> POP Response: +OK webmail.fireflycom.net Zimbra POP3 server ready
  0.517997 -> x.x.x.180 POP Request: CAPA
  0.777562  x.x.x.180 -> TCP 110 > 49460 [ACK] Seq=54 Ack=7 Win=5888 Len=0 TSV=3514443650 TSER=17385351
  0.777925  x.x.x.180 -> POP Response: +OK Capability list follows
  0.973338 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=7 Ack=163 Win=17308 Len=0 TSV=17385396 TSER=3514443650
600.800473  x.x.x.180 -> TCP 110 > 49460 [FIN, ACK] Seq=163 Ack=7 Win=5888 Len=0 TSV=3514593650 TSER=17385396
600.800562 -> x.x.x.180 TCP 49460 > 110 [ACK] Seq=7 Ack=164 Win=17308 Len=0 TSV=17445379 TSER=3514593650
No Email Scanner Active: Note whole transaction complete in 5 seconds
  0.000000 -> x.x.x.180 TCP 49454 > 110 [SYN] Seq=0 Win=8192 Len=0 MSS=1260 WS=2 TSV=17365859 TSER=0
  0.257058  x.x.x.180 -> TCP 110 > 49454 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1452 TSV=3514394921 TSER=17365859 WS=7
  0.257162 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=1 Ack=1 Win=17472 Len=0 TSV=17365884 TSER=3514394921
  0.513003  x.x.x.180 -> POP Response: +OK webmail.fireflycom.net Zimbra POP3 server ready
  0.703620 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=1 Ack=54 Win=17416 Len=0 TSV=17365929 TSER=3514394985
  1.019210 -> x.x.x.180 POP Request: AUTH
  1.311944  x.x.x.180 -> TCP 110 > 49454 [ACK] Seq=54 Ack=7 Win=5888 Len=0 TSV=3514395176 TSER=17365961
  1.312291  x.x.x.180 -> POP Response: -ERR mechanism not specified
  1.316545 -> x.x.x.180 POP Request: CAPA
  1.682771  x.x.x.180 -> POP Response: +OK Capability list follows
  1.691405 -> x.x.x.180 POP Request: STLS
  1.947000  x.x.x.180 -> POP Response: +OK Begin TLS negotiation
  1.960657 -> x.x.x.180 POP Request: \026\003\001\000\226\001\000\000\222\003\001\000\002\245\225 \311\026\355\220\232|\250\f%\323\264\366b|\271\207h\370E\036w\303[~\030\002u\000\0008\300
  2.228589  x.x.x.180 -> POP Continuation
  2.231638  x.x.x.180 -> POP Continuation
  2.231692 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=174 Ack=2716 Win=17472 Len=0 TSV=17366082 TSER=3514395412
  2.491021  x.x.x.180 -> POP Continuation
  2.493185  x.x.x.180 -> POP Continuation
  2.493266 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=174 Ack=4925 Win=17472 Len=0 TSV=17366108 TSER=3514395479
  2.502879 -> x.x.x.180 POP Request: \026\003\001\000f\020\000\000b\000`\316vV;\355\273\263\322\346\330\330\366jS?\374\276,\367\261\316\355\355\017\211\324`\017\226\254\222\244\345\261\337,D,\3032%\337k\3667\206a\314A\225X\303\333\267\350\362'\301\2275\214\265J'A\341m\353v\340_9?\303\333Zh\246\244\v\362Ej\324qr\004\252\376\213G\270>\352\241m\024\003\001\000\001\001\026\003\001\0000GX#\030E\243\373\277\024|\214~\035\036\032h\215\273\273\234\016\341\217:\265\243rz\a\270*E\306\276\276;\301\234\2718[\217r\353\260\365\231\323
  2.765868  x.x.x.180 -> POP Continuation
  2.964752 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=340 Ack=4931 Win=17464 Len=0 TSV=17366155 TSER=3514395548
  3.227486  x.x.x.180 -> POP Continuation
  3.229354 -> x.x.x.180 POP Request: \027\003\001\000 \342F\367T\203\213\354\177
  3.486224  x.x.x.180 -> POP Continuation
  3.489983 -> x.x.x.180 POP Request: \027\003\001\000 MJ
  3.746227  x.x.x.180 -> POP Continuation
  3.750814 -> x.x.x.180 POP Request: \027\003\001\0000\374PT\353
  4.007085  x.x.x.180 -> POP Continuation
  4.021543 -> x.x.x.180 POP Request: \027\003\001\000@\031\2526\370\355\264\212\305\332\002\246\316\242+\353E\023U\341\242C(M\303\332\240\347~_\225\225`\271\205\262{h[\322\256\362#\372\004V[\316\022\312\334>\230\027c}\310F\326\037\236*\276\316\017
  4.284250  x.x.x.180 -> POP Continuation
  4.301080 -> x.x.x.180 POP Request: \027\003\001\000 \375\036\343\331\2275\225M\311\222\261\202\334\302\346Zk\275\002\361\340\271;#cX1\025\004\272/\025
  4.558686  x.x.x.180 -> POP Continuation
  4.585215 -> x.x.x.180 POP Request: \027\003\001\000 sy\324D\031\336\376P\340\225c\307\214\032\332\356\255T\027fo\362\333\3020Y\020\205P\237\344\305
  4.841129  x.x.x.180 -> POP Continuation
  4.841541  x.x.x.180 -> POP Continuation
  4.841606 -> x.x.x.180 TCP 49454 > 110 [ACK] Seq=610 Ack=5468 Win=16928 Len=0 TSV=17366343 TSER=3514396067
  4.854393 -> x.x.x.180 TCP 49454 > 110 [FIN, ACK] Seq=610 Ack=5468 Win=16928 Len=0 TSV=17366344 TSER=3514396067
  5.112080  x.x.x.180 -> TCP 110 > 49454 [ACK] Seq=5468 Ack=611 Win=7936 Len=0 TSV=3514396135 TSER=17366344

Open in new window

  • 3
  • 3
1 Solution
Do you have any firewall installed??
red_nectarAuthor Commented:
No firewall - and a correction regarding the code snippet - corrections in BOLD:
The first examples shows a FAILED connection with the email scanner activated.  The second shows the same connection WITH the email scanner de-activated.
Managed Security Services Webinar - March 15

Selecting the right managed security services platform to grow your business can be a huge undertaking. Join WatchGuard and Frost & Sullivan in an upcoming webinar as we dive into the key elements of selecting a vendor platform and partnership to fuel a successful MSSP business.

red_nectarAuthor Commented:
Open the AVG Free User Interface application
Select Tools->Advanced settings (See diagram below)
In the list on the left hand side, select E-mail Scanner->Servers.  On the right hand side you will see a button to [Add new server]
Click on the [Add new server] button, and give the server a name (eg mail.example.com) and leave the type as POP3
Now this is where things get tricky, (because of a bug in the AVG interface).  We actually want to specify the Type of Login as USER/COMPUTER, but (here's the bug) if you select the USER/COMPUTER option right now, you won't be able to type in your user/computer details at the prompt. So, the work-around is to select Type of login as Fixed host, enter a host as user/server:port (eg red_nectar/mail.example.com:110) THEN select Type of login as USER/COMPUTER.
In the Additional settings section, leave the local port as 10111 and set the Connection to SSL default.
Finally , make sure that under the E-mail client POP3 server activation, the checkbox is ticked to Activate this server and use it for receiving e-mail
Now, in Thunderbird, select Tools-> Account Settings, and for the account you want AVG to scan, select the Server Settings option in the left hard window. (See other diagram below). In the right hand window, set the Server Name: to and the Port to 10111 (to match the settings in AVG free).  Enter your User Name: in standard format (eg red_nectar@example.com) and under security settings, select TLS, if available.
The next time you check for mail, you should be prompted for your password, and so long as you get that right, you shoulod find that your email gets scanned and then ends up in your inbox where you wanted it.

red_nectarAuthor Commented:
Thanks for the lead warturtle - it put me on the right path to come to a solution which I have posted above in case anyone else needs to repeat the exercise.
Thats good stuff, I am adding it to my knowledgebase so that I can help others in a similar situation. Thanks for the feedback and the points.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now