Avatar of nhnerd
nhnerd
Flag for United States of America asked on

Understanding exchange SMTP Logs to help troubleshoot local app issue

I'm working with a third party programming sending emails through a special connector on my exchange. there are supposed to be 150+ emails sent through the connector. there are only about 21 going through. the first 20 go out then about 2.5 hrs one last email goes. the programmers says it is not them, but my SMTP logs only show 24 emails going through the connector with 3 rejected do to bad "MAIL FROM :" The program is authenticating as one user and sending as another. that's easy to fix.

But in the logs, i see the following initial connection stream. Seams a little off. can someone explain this; There looks to me 2 login / authentication connections (domain name and user name change to protect the Innocent)

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
EHLO Local Program server
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
EHLO Local Program server
AUTH ntlm
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
334 <authentication response>
334 <authentication response>
AUTH ntlm
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
334 <authentication response>
235 2.7.0 Authentication successful
235 2.7.0 Authentication successful
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
SMTPSubmit SMTPAcceptAnyRecipient BypassAntiSpam AcceptRoutingHeaders
domain\user
MAIL FROM:<sender@publicdomain.com>
08D3019FC1DFE572;2015-12-23T16:24:54.266Z;1
MAIL FROM:<sender@publicdomain.com>
08D3019FC1DFE573;2015-12-23T16:24:54.266Z;1
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
235 2.7.0 Authentication successful
250 2.1.0 Sender OK
250 2.1.0 Sender OK
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLO Local Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500

SMTPSubmit SMTPAcceptAnySender SMTPAcceptAuthoritativeDomainSender AcceptRoutingHeaders
MAIL FROM:<sender@publicdomain.com>
08D3019FC1DFE574;2015-12-23T16:24:54.282Z;1
RCPT TO:<recpt-1@publicemailaddress.com>
RCPT TO:<recpt-2@publicemailaddress.com>
AUTH ntlm
250-(Local Email Server) Hello [192.168.38.29]
250-SIZE 31457280
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-X-ANONYMOUSTLS
250-AUTH NTLM LOGIN
250-X-EXPS GSSAPI NTLM
250-8BITMIME
250-BINARYMIME
250-CHUNKING
250-XEXCH50
250-XRDST
250 XSHADOW
EHLOLocal Program server
220 (Local Email Server) Microsoft ESMTP MAIL Service ready at Wed, 23 Dec 2015 11:24:53 -0500
250 2.1.0 Sender OK
250 2.1.5 Recipient OK
250 2.1.5 Recipient OK
334 <authentication response>

From here the individual email are sent.

it seams the local program is creating 2 connection and then sending through me. but I'm a lonely network admin not an exchange export
ExchangeEmail ServersEmail ProtocolsSBS

Avatar of undefined
Last Comment
nhnerd

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Kimputer

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
SOLUTION
Wasim Shaikh

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Hello World

Do you enable open replay in your Exchange environment?  
Use below command to check which connector have enable external relay:
Get-ReceiveConnector | Get-ADPermission | Where {$_.User -Like '*anon*' -And $_.ExtendedRights -Like 'ms-Exch-SMTP-Accept-Any-Recipient'} | ft Identity, User, ExtendedRights

Also, here's an blog about analyze protocol log: http://social.technet.microsoft.com/wiki/contents/articles/23182.analyzing-the-protocol-logs-and-message-tracking-logs-in-exchange-2013.aspx
nhnerd

ASKER
Kimputer - Wireshark gave me time the connection ended and I was able to back in to the logs to the timeout happen

Vaseem Mohammed - SMTPMaxMessagesPerConnection was the issue. somehow the max was reduced to 20. not sure how as I'm the only admin. maybe an 2011 SBS patch? Plus had to learn some ps commands. I'm an old GUI person.

Hello World - Sorry, I do not want an open rely inside my network. I'm authenticating fine.
nhnerd

ASKER
Thank you all for chiming in
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes