Subject: [Asrg] Empty mail transactions

From: "Peter J. Holzer" <[email-masked]>
Date: Mon, 10 Jan 2005 23:59:56 +0100

And now for something completely different :-)

For at least several months I have been seeing a large number of empty
mail transactions. Currently more than half of our connections consist
only of an EHLO command. The client disconnects immediately after the
response.

Is anybody else noticing this? If so, do you have an idea what this is
about? It looks like some kind of fingerprinting of course, but I'm
curious why so many are interested in the version of our mail server and
the extensions it supports. Maybe a worm trying to find a specific
vulnerable SMTP server? 

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Gadi Evron <[email-masked]>
Date: Wed, 12 Jan 2005 02:41:06 +0200

> the extensions it supports. Maybe a worm trying to find a specific

Yes. We have seen this.

Actually, I found that when enough open connections are made (and 
obviously not closed), sendmail would eventually open enough processes 
to bring about an effective DoS, and die.

Our first encounter with this was with a bad application someone 
developed, the second was not so benign. No idea about what/who did it, 
but it did not persist like a worm usually would.

	Gadi.

---

From: Gadi Evron <[email-masked]>
Date: Wed, 12 Jan 2005 02:48:56 +0200

> only of an EHLO command. The client disconnects immediately after the

Ahh, I missed the immediately disconnects part. I'll blame it on the 
very early (late) hour.

> the extensions it supports. Maybe a worm trying to find a specific

Did you check to see from how many different IP's this is happening? It 
is *possible* that this is just one broken worm, on one pwned system.

	Gadi.