From owner-freebsd-questions  Sun Sep  8 20:37:54 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id UAA22380
          for questions-outgoing; Sun, 8 Sep 1996 20:37:54 -0700 (PDT)
Received: from gdi.uoregon.edu (cisco-ts8-line9.uoregon.edu [128.223.150.73])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id UAA22371
          for <freebsd-questions@FreeBSD.org>; Sun, 8 Sep 1996 20:37:49 -0700 (PDT)
Received: from localhost (dwhite@localhost) by gdi.uoregon.edu (8.7.5/8.6.12) with SMTP id UAA00380; Sun, 8 Sep 1996 20:37:56 -0700 (PDT)
Date: Sun, 8 Sep 1996 20:37:56 -0700 (PDT)
From: Doug White <dwhite@gdi.uoregon.edu>
Reply-To: dwhite@resnet.uoregon.edu
To: Kurt Schafer <kurt@cyberbeach.net>
cc: freebsd-questions@FreeBSD.org
Subject: Re: Mail bombing perhaps ?
In-Reply-To: <1.5.4.32.19960908143425.008b48ac@post.cyberbeach.net>
Message-ID: <Pine.BSI.3.94.960908203717.224Q-100000@gdi.uoregon.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-questions@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

On Sun, 8 Sep 1996, Kurt Schafer wrote:

> When I watch my maillog, I see requests from this site come in every minute
> or two like clockwork.
> 
> 
> Sep  7 13:25:03 wave sendmail[1204]: NAA01204:
> from=<owner-bonsai@HOME.EASE.LSOFT.COM>, size=0, class=0, pri=0, nrcpts=0,
> proto=ESMTP, relay=root@cicerone.uunet.ca [142.77.1.11]
> Sep  7 13:26:02 wave sendmail[1212]: NAA01212:
> from=<owner-bonsai@HOME.EASE.LSOFT.COM>, size=0, class=0, pri=0, nrcpts=0,
> proto=ESMTP, relay=root@cicerone.uunet.ca [142.77.1.11]
> Sep  7 13:27:05 wave sendmail[1221]: NAA01221:
> from=<owner-bonsai@HOME.EASE.LSOFT.COM>, size=0, class=0, pri=0, nrcpts=0,
> proto=ESMTP, relay=root@cicerone.uunet.ca [142.77.1.11]
> Sep  7 13:28:06 wave sendmail[1228]: NAA01228:
> from=<owner-bonsai@HOME.EASE.LSOFT.COM>, size=0, class=0, pri=0, nrcpts=0,
> proto=ESMTP, relay=root@cicerone.uunet.ca [142.77.1.11]
> 
> However, when I grep through the log for the corresponding identifiers, ie
> NAA01228, I never see any evidence of the mail actually arriving anywhere ?

I think you have a sendmail problem.  I received 5 copies total of your
two messages.

> Does this make any sense ? Is there some other way I can determine whether
> or not the mail from this site, as evidenced by the transactions above, are
> actually arriving in any of my users mailboxes ?

Notice size=0.  It's dying before it's transmitting anything.

Doug White                              | University of Oregon  
Internet:  dwhite@resnet.uoregon.edu    | Residence Networking Assistant
http://gladstone.uoregon.edu/~dwhite    | Computer Science Major