Forum Discussion
Mike_Pimlott_61
Nimbostratus
NimbostratusSMTP response code checking
Hi (again)
why is it that first forays into coding always happen to be the difficult things to get your head around?
I need to see if there is a way in which I can query an SMTP packet to get the response code to query for a 5xx error, to then pass this to a pool with a very low connection limit?
the pool will have members which are attributed to another pool for all email, so I need to make it simpler I think. so. check all SMTP traffic to look for an SMTP error code (550 etc.) to limit connections to the mail server, whilst letting the other SMTP traffic pass through unlimited to the "proper" mail pool.
any suggestions? I have tried the following as the first pass;
when CLIENT_ACCEPTED {
log local0. "this is the TCP payload: [TCP::payload]"
if {[TCP::local_port] == 25} {
TCP::collect 200
}
}
when CLIENT_DATA {
if { [TCP::payload] contains "550 " } {
pool no_NDR_allowed}
else {pool IMWW_Pool}
TCP::release
}
but it just stops all mail - any help appreciated.
hoolioCirrostratus
Hello,
There won't be any data (TCP::payload) in the CLIENT_ACCEPTED event. But that is the event where you would potentially want to start collecting the payload.
Also, the 550 response is going to be sent from the server back towards the client, so you would want to look at the server data (not client data).
I don't know SMTP well enough to suggest the best way to write such a rule, but try searching the forum for SMTP. The codeshare also has an SMTP proxy rule that might give you some reference material.
RFC2821 documents the steps in establishing an SMTP connection (Click here). Section 3.3 seems relevant.
Anyone else have ideas?
Aaron