[cobalt-users] problems while sending mail on XP

["DutchNet Support" <support@xxxxxxxxxxxxx>]

Hi all,

a customer of ours is experiencing problems while sending mail with Outlook
Express 6 on Windows XP Home Edition.
While sending mail he runs into a timeout error.
He has no problems collecting e-mail from the same server.

Checking the logs on our RaQ4 server I found these entries from PortSentry
1.1 (see at the end of this message) which explains the timeout :-)

On none of our other servers do we see this entry in any log. All servers
have all updates and the same version for pmfirewall, logcheck en portsentry
installed.

He has Norton Antivirus installed but it only checks incoming mail and not
outgoing mail. We were succesfull sending e-mail once. It was after a reboot
of his machine where Norton Antivirus was not automatically started. Once we
started Norton Antivirus again we got the same problem back.

I understood that TCP fragmenting might be the cause for using port 65535
( -1 ) but I understood as well that this port might be used by trojans.

my questions:

1 - Could it be that the customer is infected in anyway?

2 - if he is not infected how can we prefend this log from happening and
make him send his mail again, I tried setting port 65535 to accept (in
pmfirewall.rules.local) but that did not work.

3. If it is TCP fragmenting how can I enable, and should I, TCP
defragmenting.

entry in kernel.log
Jul 26 10:37:34 ww3 kernel: Packet log: input DENY eth0 PROTO=6
zz.zzz.zzz.zzz:65535 xx.xx.xxx.xxx:65535 L=52 S=0x00 I=5897 F=0x00B5 T=123
(#39)

Any input/advise is welcome

regards

Erik Venema
DutchNet