See the following log from a victimized mail server:
...
18:43:02: [4:2] P=005 D=gmail.com TTL=(41) MX=[ gmail-smtp-in.l.google.com] {64.233.163.114}
18:43:02: [4:2] Attempting MX: P=005 D=gmail.com TTL=(41) MX=[ gmail-smtp-in.l.google.com] {64.233.163.114}
18:43:02: [4:2] Attempting SMTP connection to [64.233.163.114 : 25]
18:43:02: [4:2] Waiting for socket connection...
18:43:02: [4:2] Socket connection established (x.x.x.x : 1038 -> 64.233.163.114 : 25)
18:43:02: [4:2] Waiting for protocol initiation...
18:43:02: [4:2] <-- 220 mx.gmail.com ESMTP j7si1736987nzd
18:43:02: [4:2] --> EHLO zzz.com.cn
18:43:03: [4:2] <-- 250-mx.gmail.com at your service, [x.x.x.x]
18:43:03: [4:2] <-- 250-SIZE 20971520
18:43:03: [4:2] <-- 250-8BITMIME
18:43:03: [4:2] <-- 250 ENHANCEDSTATUSCODES
18:43:03: [4:2] --> MAIL From:
18:43:03: [4:2] <-- 250 2.1.0 OK
18:43:03: [4:2] --> RCPT To:
18:43:04: [4:2] <-- 250 2.1.5 OK
18:43:06: [4:2] --> DATA
18:43:06: [4:2] <-- 354 Go ahead
18:43:06: [4:2] Sending
19:11:42: [4:2] Winsock Error 10054 Connection was reset by the other side!
19:11:42: [4:2] Error writing to socket
19:11:42: [4:2] This message is 28 minutes old; it has 32 minutes left in this queue
19:11:42: [4:2] SMTP session terminated (Bytes in/out: 216/37019)
19:11:42: ----------
The administrator of this victimized server reported that they could send emails to other domestic mail servers without any problems, but experienced several strange problems while sending messages to Gmail users.
I speculate that currently the Great Firewall can intercept all server-to-sever SMTP traffic (unencrypted) between Chinese mail servers and Gmail’s servers, by filtering packet contexts according to the sensitive keywords defined by the government and then resetting the connections of suspected sessions. So the above happened, as the log recorded.
Apparently, the filtering program of the Great Firewall does not work correctly, because all the blocked mails from the above mentioned server were completely business messages. That’s why I call the server a victim.
No comments:
Post a Comment