What's blocking outbound port 25--ethereal sees nothing.... 4

[JMCraig]

Hi Folks,

I didn't know what forum to put this in--it's hardly a perfect fit anywhere. At any rate, here goes: I have a product that I've sold and set up more than 2 dozen times--it uses SMTP to send email. Very simple setup--you define the SMTP server and it works.

Now I have a client where I get a "can't connect" error message when the program tries to connect to the SMTP server. OK, no biggy, right? There's something blocking that port. Here's where it gets interesting:

The box the program is running on is Windows XP
There's no firewall software (the MS XP firewall is off)
There's no IP filters configured (allowing all for all three protocols Windows has--including TCP)

So it sounds like it might be being blocked in some other way, but, what seems the most basic SMTP test to me:

telnet the.smtp.host 25

Not only fails, but if I run this with ethereal capturing traffic, it doesn't even show any outbound packets; not a one.... Huh?

Pings work and ethereal sees the ICMP packets going out and coming back. If I try to telnet to port 23, ethereal sees three SYN packets (the email server doesn't respond) and telnet times out. Fair enough.

OK, so how is outbound port 25 traffic being blocked so thoroughly? The program shows the same behavior with ethereal capturing packets: no outbound packets to try to establish the TCP socket to the SMTP server.

I'm at a loss here. Any ideas gratefully accepted!

John

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[mrdenny]

Many ISPs block port 25 traffic to any SMTP server except there own SMTP server to try to prevent SPAM. This might be the problem.

Denny
MCSA (2003) / MCDBA (SQL 2000) / MCTS (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[JMCraig]

I appreciate the thought, but the problem with this theory is that the blocking is clearly inside the PC itself--otherwise, ethereal would see the outbound SYN packets (and no response).

This isn't an issue of a time-out and an externally blocked port. The PC's IP stack is somehow not allowing the outbound packets to port 25 to go out at all.

John

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[biglebowski]

Try this I've used it to test for oracle ports being blocked by fireawalls and it's pretty good.

http://support.microsoft.com/default.aspx?kbid=832919

When I was born I was so suprised I didn't talk for 18 months

 

[LawnBoy]

Are you sure something else hasn't already "grabbed" port 25? I'm thinking trojan, backdoor, etc.

 

[drew1701d]

Your client have McAfee 8.0i Enterprise Antivirus or another flavor? McAfee and some others have the ability to block port 25 so as to prevent mass mailing worms from sending mail. Chances are its an access protection policy from the Antivirus.

"I'm certifiable, not certified. It just means my answers are from experience...not a book

 

[drew1701d]

PS: By default McAfee 8.0i blocks port 25 locally to prevent mass mailing worms. I typically remove it either manually or by using the McAfee Protection Pilot/ePolicy Orchestrator management tool to pass down policies to not block that port where circumstances require it to be available at the client level. The antivirus itself does a good job catching mailing worms before they even have a chance to act.

"I'm certifiable, not certified. It just means my answers are from experience...not a book

 

[JMCraig]

Thanks LawnBoy and drew1701d. We did have them check for spyware (which my local computer store guy suggested). I think it's quite likely that they have some institution-wide antivirus setup (even if it's not McAfee). I'll let you know if that turns out to be it.

John

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[JMCraig]

You nailed it, drew1701d. That was it exactly: McAfee was blocking the port. Now the connection attempt to the SMTP server is timing out--but at least the packets are going out. So, now we at least are making some progress.

Thanks,

John

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[drew1701d]

Glad I could help, new it had to be something along those lines, now make sure McAfee isn't on the SMTP server, or something server configuration wise i.e. a built in firewall isn't stopping it at that point.

V/R
Drew

"I'm certifiable, not certified. It just means my answers are from experience...not a book

 

[Wendy1053]

Just had the exact same problem with port 25 blocked - McAfee the problem! drew1701d you deserve a medal. Ta

 

[tfg13]

How about giving him a star?