Atomicorp

Hi,

I got a very annoying error. Pop3/imap connections drop spontaneously. there might be other losses too. but those are more noticible than a web request.
Checking with tcpdump I see dup acks and retransmissions corresponding to these drops.
some frame errors (279- over ifconfig) on the nic as well. shame on me I dont know 100% for sure if the frame errros amount is old or not. the problems started today, nothing changed on the sys, server is not in heavy load nor high traffic on it.

Any other ideas except cabling, switchport or nic?
its definitely not the client, not the clients provider or a clients application.
contacted 1and1 for cabling, switchport or nic but they are slow like always.

Thanks for any thoughts.

still not much further with my investigation:
what I see in the dumps is:
always when the client is claiming of no access like 0x800CCC0F from Outlook for example
I see these entries in tcpdump from one stream:
prior are correct login, syn,acks, password request, stat and a quit. Than
............................................................OK, Bye-Bye
No. 1745: server>client; TCP; pop3 > clientport [FIN,ACK]
No. 1746: client>server; TCP; [TCP Previous segment not captured] clientport > pop3
No. 1747: client>server; TCP; clientport > pop3 [FIN,ACK]
No. 1748: server>client; TCP; pop3 > clientport [ACK]

whenever the unneeded packet is missing the client does not moan.
which makes sense because login works and mails can be send and received.
than it seems that the client wants to connect after the logout/quit and receives of course not the wished response.

Could it be that your hitting Courier limits or does this for instance also happen on one server checking one mailbox?

See the MAXDAEMONS and MAXPERIP settings in these files:

IMAP: /etc/courier-imap/imapd
IMAPS: /etc/courier-imap/imapd-ssl (by default using the values set in imapd)
POP3: /etc/courier-imap/pop3d
POP3S: /etc/courier-imap/pop3d-ssl (by default using the values set in pop3d)

Hi breun,

thanks for getting back. I had increased these limits to a high value years ago.
And it occurs also with one request from one client with one mailbox account.

Strange is that the error is gone over night.
I had adressed the issue yesterday at 1and1.
The replied that they are not able to track it down.

But I do believe that they did something with knowing that they solved it like:
- taking a server down that massively send ARP requests or broadcasts im my subnet
- stopped a small ddos
- reseted a switch or router or switchport
- or other network related problems.

What makes me sick is that I don't know the root of the problem. Except it wasnt me, my server or the clients.
And I dont know if it starts again or not.

We will see.
Thanks breun.