Please see the filtered entries in your (very helpful!) pcap file. I highlighted (15:30:11) the line where SpamFilter finishes sending the email to your server at 10.11.11.120. The pcap show that the correct end-of-email sequence (<CR><LF>.<CR><LF> --> 0d-0a-2e-0d-0a) is present. There are some fragmented packets being resent after that, but the remote server never sends a "250 OK" acknowledgment that the email was received. After exactly 60 seconds of not receiving any data, SpamFilter sends a FIN to end the transmission due to a timeout. This 60 second value can be changed via the following entry in the SpamFilter.ini file:
;Timeout when delivering emails to the destination SMTP server (in seconds) ReadTimeoutOutgoing=60
However increasing the timeout to something longer for such a small email does not make much sense. You could however check to see if your SMTP server is employing some sort of anti-spam measures itself, which may include delaying accepting emails for more than 60 seconds. In this case, you can either disable that feature on your dest. SMTP server, or see if you can exclude SpamFilter's IP from it, or try increasing the "ReadTimeoutOutgoing" value in SpamFilter.
------------- Roberto Franceschetti
http://www.logsat.com" rel="nofollow - LogSat Software
http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP
|