[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] Qube 2 Qpopper Unable to obtain socket and address of client

At 09:27 AM 3/24/01 -0500, gsh wrote:

On Fri, 23 Mar 2001 GebaDFW@xxxxxxx wrote:

> This past week the mail log on our Qube 2 has begun to fill up with the
> following message:
>
> qube in.qpopper [30816]: Unable to obtain socket and address of client:
> Socket is not connected (134)
>
> Can someone please tell me what this means and what I can do to prevent this? > I have searched the archives and also read the FAQ at the Qualcomm / Qpopper 
> web site.  I have also done a Google search on messages posted to
> Qpopper@xxxxxxxxxxxxxxxxxx There are some posts which mention this error but 
> nothing really explains what it is and what should be done about it.

It most likely means someone port scanned your server, port scans
disconnect so fast , or don't completly connect, so the listening
connection isn't able to get the complete information about the connection
(eg the incoming IP address) . This can also be caused by really bad
connectivity, where the client tries to connect but times out before they
can finish connecting. Bad firewall config could in theory do this
also. The error is actually somewhat generic ;)

In and of itself , it's harmless, aside from filling up your logs, but as
a possible indication of someone playing, or network problems it may be
worth exploring..

 gsh
Since it's filling up the mail log, I'd think it's not a port scan. I'd guess it's a misconfigured client. If a user is set to check for mail every n minutes, and can't connect properly, that would likely fill the log file (do the errors occur at some fixed time interval?). See if you can place an IP address to the faulty client by checking time stamps in the Secure Log.
It may be easier to troubleshoot this when few people are accessing the machine.
You may also want to send out an email to your users checking whether anyone has had problems accessing e-mail. It's possible that the user is unsuccessful the first try, then connects on the second (and thus have not brought the problem up with you). 

Peter