Re: [cobalt-users] raq4 - sendmail rejecting connections - busy machine?

[elmer@xxxxxxxxxxxxxx]

On Fri, 23 Feb 2001, tony simpson wrote:

} This happened another day too.
}
} Why would sendmail be rejecting connections?  There have only been a few
} emails through the system and the active monitor gui says that the load on
} the cpu and mail has been low.

	This is only one possibility and it may not be the problem,
but this kind of thing will happen if someone is a dictionary type
attack against sendmail in order to locate valid user names. My
experience is that servers upon which mailing lists with names such
as "ecommerce@" are being hosted are often probed in this manner.

	The only way I know to determine if something like this is
the cause (their may be other ways) is by monitoring the traffic in
and out of the server on an IP level. IPtraf can be found at
Freshmeat. It contains a precompiled binary. Thus all you'd have to
do is open the tar.gz file somewhere on the server and do then do a
./iptraf in the resulting directory as root.

	It's worth installing as once it is you can then view the
traffic in/out of the server at any time. You'd be amazed at what
you can learn just by watching it.