POP times out on every computer except 1
 

We have three servers. For this I will call them server A, B and Mail Server.

A and B are both Windows 2000 servers running Windows 2000 Terminal Services.

Server A is our old server that has been replaced by B.

We can receive any size emails and any number of emails from the Mail Server from Server A. It works quick with no problems.

Server B will get most emails. Sometimes it will start then time out half way through. Other times it will time out right at the start before even downloading any emails.

I tested some local workstations by setting up test accounts. No workstation can receive emails that the new server cant get either. Only server A can.

I can not see any settings that would prevent other computers from being able to receive emails.

I can telnet to port 110 from any computer. I can receive small emails on any computer.

The 3 servers are connected into the same switch using Cat5e.

The New server has dual Intel gigabit lan cards
The old server has dual 10/100 intel lan cards

The mail server is running Red Hat 8 with Send Mail.

The clients are using Outlook Express and Outlook. Both fail the same.

After some more testing I have found that it’s only some emails that are preventing them from being received. These emails I have found so far to be spam.

I did some packet capturing when using telnet to port 110.

+OK POP3 localhost v2001.78rh server ready [ISafe POP3 Proxy]
USER xxxx

+OK User name accepted, password please
PASS xxxx

+OK Mailbox open, 74 messages
stat

+OK 74 2283359
list

+OK Mailbox scan listing follows
1 4064
2 19392
3 5150
4 1716
5 1509
6 2662
7 362848
8 25615
9 6075
10 6175
11 8732
12 8779
13 7819
14 41410
15 35010
16 35590
17 35419
18 1503
19 35553
20 35557
21 35601
22 35620
23 35550
24 35602
25 35537
26 35473
27 35563
28 35540
29 35453
30 35537
31 35458
32 35426
33 35477
34 35565
35 35803
36 38754
37 35467
38 35428
39 35507
40 35538
41 35534
42 35544
43 35531
44 35449
45 35832
46 35611
47 345433
48 3458
49 1745
50 3019
51 7847
52 14169
53 1759
54 2688
55 2143
56 9384
57 7082
58 35587
59 35571
60 2362
61 6895
62 2926
63 7376
64 2289
65 5343
66 2871
67 2360
68 3850
69 5110
70 32086
71 75076
72 47101
73 4522
74 5329
.
uidl

+OK Unique-ID listing follows
1 413e3ab300000001
2 413e3ab300000002
3 413e3ab300000003
4 413e3ab300000004
5 413e3ab300000005
6 413e3ab300000006
7 413e3ab300000007
8 413e3ab300000008
9 413e3ab300000009
10 413e3ab30000000a
11 413e3ab30000000b
12 413e3ab30000000c
13 413e3ab30000000d
14 413e3ab30000000e
15 413e3ab30000000f
16 413e3ab300000010
17 413e3ab300000011
18 413e3ab300000012
19 413e3ab300000013
20 413e3ab300000014
21 413e3ab300000015
22 413e3ab300000016
23 413e3ab300000017
24 413e3ab300000018
25 413e3ab300000019
26 413e3ab30000001a
27 413e3ab30000001b
28 413e3ab30000001c
29 413e3ab30000001d
30 413e3ab30000001e
31 413e3ab30000001f
32 413e3ab300000020
33 413e3ab300000021
34 413e3ab300000022
35 413e3ab300000023
36 413e3ab300000024
37 413e3ab300000025
38 413e3ab300000026
39 413e3ab300000027
40 413e3ab300000028
41 413e3ab300000029
42 413e3ab30000002a
43 413e3ab30000002b
44 413e3ab30000002c
45 413e3ab30000002d
46 413e3ab30000002e
47 413e3ab30000002f
48 413e3ab300000030
49 413e3ab300000031
50 413e3ab300000032
51 413e3ab300000033
52 413e3ab300000034
53 413e3ab300000035
54 413e3ab300000036
55 413e3ab300000037
56 413e3ab300000038
57 413e3ab300000039
58 413e3ab30000003a
59 413e3ab30000003b
60 413e3ab30000003c
61 413e3ab30000003d
62 413e3ab30000003e
63 413e3ab30000003f
64 413e3ab300000040
65 413e3ab300000041
66 413e3ab300000042
67 413e3ab300000043
68 413e3ab300000044
69 413e3ab300000045
70 413e3ab300000046
71 413e3ab300000047
72 413e3ab300000048
73 413e3ab300000049
74 413e3ab30000004a
.
retr 1

+OK 4064 octets
X-ISafe-KeepAlive:0


Connection to host lost.

As you can see it works up until trying to retrieve the first email. This one was spam. I deleted this email and all other emails came through on the new server right away.
It sat there for around ten minutes before it gave the connection lost message.

I then found a post where someone found a similar problem
lists.roaringpenguin.com/pipermail/mimedefang/2004-February/019702.html

This person is also using the same version of POP3 (v2001.78rh).

This brings me to think that the server is the problem but how can the old server still successfully download any email?

The only difference that I can find is that every client it has failed on has been using Outlook Express 6.00.2800.1123 or Outlook 2003 where as the old server is running 6.00.2600.0000.

I think this theory could be dead though as I used Mozilla Thunderbird to get emails on an account that was locked and it also failed on the same email.

The only other thing I can think of is the packet sizes on the network card itself. That maybe the mail server is sending the spam emails to the client with the wrong packet size which the other computers can’t handle.