Paul de Weerd wrote:
quoted text
> Hi Renaud,
> 
> On Mon, Dec 10, 2007 at 04:50:36PM +0100, Paul de Weerd wrote:
> | Have you actually seen these packets live on the wire ?
> 
> I re-read your original mail, and it turns out you have seen these
> packets on the wire. Sorry for the too-quick-answer ;P

No problem. The firewall admin told me he was blocking packets from 127.0.0.1
originating from the antispam servers.

quoted text
> 
> | I doubt it. In general (the recommended setup), pf redirects incoming
> | requests to 127.0.0.1:8025, the port where spamd is listening *on
> | localhost*. Replies such as ACK's etc. *MUST* originate from
> | 127.0.0.1:8025 in this case. PF will take care of rewriting the packet
> | to the address the client originally used to contact your mailserver
> | (spamdserver).
> 
> For some reason, pf doesn't seem to take care of rewriting the return
> traffic where it should. Can you confirm there is a matching pf-state
> in the state table when you see this sort of traffic ?
> 

It is quite hard to capture as it seems sporadic and servers are heavy loaded:

tcpdump: listening on em0, link-type EN10MB
Dec 10 17:07:18.585359 00:15:17:19:0e:be 00:04:23:09:79:68 0800 113:
127.0.0.1.8025 > 217.132.142.68.2199: FP 959669614:959669673(59) ack 2605929486
win 65535

all tcp 127.0.0.1:8025 <- 157.164.187.68:25 <- 217.132.142.68:4557
FIN_WAIT_2:FIN_WAIT_2
all tcp 127.0.0.1:8025 <- 157.164.187.68:25 <- 217.132.142.68:1052
FIN_WAIT_2:FIN_WAIT_2
all tcp 127.0.0.1:8025 <- 157.164.187.68:25 <- 217.132.142.68:1181
FIN_WAIT_2:FIN_WAIT_2
all tcp 127.0.0.1:8025 -> 217.132.142.68:2199       CLOSING:CLOSED

I guess the last one is the one I see on the firewall.

-- 
010100100110010101101110011000010111010101100100
010000010110110001101100011000010111001001100100

[demime 1.01d removed an attachment of type application/x-pkcs7-signature which had a name of smime.p7s]