0

It is a cPanel server and from /var/log/exim_mainlog, I can see that, there are too many connections to the server. Mostly the number of action connection will be less than 25. But even after increasing the maximum connection from 100 to 150, still we are getting too many connection problem.

2016-03-11 15:33:24 Connection from [216.113.172.65]:59122 refused: too many connections 2016-03-11 15:33:25 Connection from [216.158.225.200]:44107 refused: too many connections 2016-03-11 15:33:25 Connection from [213.61.222.76]:53953 refused: too many connections 2016-03-11 15:33:27 Connection from [46.23.76.98]:42336 refused: too many connections 2016-03-11 15:33:27 Connection from [91.194.248.147]:37566 refused: too many connections

Looks like SMTP server is kind of under attack or something like slowloris.

How can I solve this problem ?

Open rely is not allowed in server. We have verified it.

Improve this question

1 Answer 1

Reset to default
1

I have asked this question and as we have solved this problem, I want to answer it, so that it helps someone. It was a very rare issue and difficult to find out the root cause, though the problem is simple.

When we get too many connections from various IP address, We thought that, it could be DDOS. After analyzing the too many connection, We have found out that, all the connections are coming from legitimate website such as linkedIn, Google, Facebook, and so on.

Also we thought that, there could be a problem with eth0 or eth1 port, but actually not.

After one day of debugging, We have found out that, there is a problem i the MTU (max transfer unit) of the TCP/IP packet. SMTP server all of sudden started rejecting all the packets above size 1457. So most of the packets coming to SMTP server are 1500 in size. As these packets didn't reach the SMTP server, the others servers are keep trying to deliver the mails again & again.

We have verified the problem with ping "IP Addr" -l 1472

The actual problem was with some ISP, in some network hub the packets were rejected above 1457 bytes.

ping -s 1472 localhost (linux) (28 bytes for ICMP header and remaining are pay load)

Improve this answer
1
  • Can you explain your answer? How did you solve it? What IP Addr did you use when ping "IP Addr" -l 1472? Commented Oct 12, 2022 at 0:28

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.