Understanding exchange SMTP Logs to help troubleshoot local app issue
I'm working with a third party programming sending emails through a special connector on my exchange. there are supposed to be 150+ emails sent through the connector. there are only about 21 going through. the first 20 go out then about 2.5 hrs one last email goes. the programmers says it is not them, but my SMTP logs only show 24 emails going through the connector with 3 rejected do to bad "MAIL FROM :" The program is authenticating as one user and sending as another. that's easy to fix.
But in the logs, i see the following initial connection stream. Seams a little off. can someone explain this; There looks to me 2 login / authentication connections (domain name and user name change to protect the Innocent)
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
EHLO Local Program server
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
AUTH ntlm
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
334 <authentication response>
334 <authentication response>
AUTH ntlm
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
334 <authentication response>
235 2.7.0 Authentication successful
235 2.7.0 Authentication successful
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE572;2015-12-2
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE573;2015-12-2
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
235 2.7.0 Authentication successful
250 2.1.0 Sender OK
250 2.1.0 Sender OK
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE574;2015-12-2
RCPT TO:<recpt-1@publicemailadd
RCPT TO:<recpt-2@publicemailadd
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLOLocal Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
250 2.1.0 Sender OK
250 2.1.5 Recipient OK
250 2.1.5 Recipient OK
334 <authentication response>
From here the individual email are sent.
it seams the local program is creating 2 connection and then sending through me. but I'm a lonely network admin not an exchange export
But in the logs, i see the following initial connection stream. Seams a little off. can someone explain this; There looks to me 2 login / authentication connections (domain name and user name change to protect the Innocent)
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
EHLO Local Program server
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
AUTH ntlm
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
334 <authentication response>
334 <authentication response>
AUTH ntlm
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
334 <authentication response>
235 2.7.0 Authentication successful
235 2.7.0 Authentication successful
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE572;2015-12-2
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE573;2015-12-2
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
235 2.7.0 Authentication successful
250 2.1.0 Sender OK
250 2.1.0 Sender OK
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDom
MAIL FROM:<sender@publicdomain.
08D3019FC1DFE574;2015-12-2
RCPT TO:<recpt-1@publicemailadd
RCPT TO:<recpt-2@publicemailadd
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLOLocal Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
250 2.1.0 Sender OK
250 2.1.5 Recipient OK
250 2.1.5 Recipient OK
334 <authentication response>
From here the individual email are sent.
it seams the local program is creating 2 connection and then sending through me. but I'm a lonely network admin not an exchange export
Who is Participating?
Experts Exchange Solution brought to you by
Enjoy your complimentary solution view.
Get this solution by purchasing an Individual license!
Start your 7-day free trial.
I wear a lot of hats...
"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.
LVL 41
To get only the error e-mails in a clear conversation, install Wireshark, then only capture port 25 and watch all the conversations go by. When traffic dies down, the last few are probably the "error" e-mails, so click on one packet, then follow TCP stream. The whole conversation is clearly readable, including the server response on why the FROM header was rejected (could be formatting, could be an unknown user etc etc)
Experts Exchange Solution brought to you by
Your issues matter to us.
Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.
Start your 7-day free trial
Do you enable open replay in your Exchange environment?
Use below command to check which connector have enable external relay:
Get-ReceiveConnector | Get-ADPermission | Where {$_.User -Like '*anon*' -And $_.ExtendedRights -Like 'ms-Exch-SMTP-Accept-Any-R
Also, here's an blog about analyze protocol log: http://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx
Use below command to check which connector have enable external relay:
Get-ReceiveConnector | Get-ADPermission | Where {$_.User -Like '*anon*' -And $_.ExtendedRights -Like 'ms-Exch-SMTP-Accept-Any-R
Also, here's an blog about analyze protocol log: http://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx
Kimputer - Wireshark gave me time the connection ended and I was able to back in to the logs to the timeout happen
Vaseem Mohammed - SMTPMaxMessagesPerConnecti
Hello World - Sorry, I do not want an open rely inside my network. I'm authenticating fine.
Vaseem Mohammed - SMTPMaxMessagesPerConnecti
Hello World - Sorry, I do not want an open rely inside my network. I'm authenticating fine.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange
From novice to tech pro — start learning today.
Experts Exchange Solution brought to you by
Enjoy your complimentary solution view.
Get this solution by purchasing an Individual license!
Start your 7-day free trial.