Incoming email connection dropped unexpectedly with log

Unanswered Question
Oct 14th, 2009

Dear all,

     Our customer has found a problem for sender email bounced back unexpectedly, he has found the error logged from blocker.

14 Oct 2009 08:02:06 (GMT +0800)
Protocol SMTP interface Data 2 (IP on incoming connection (ICID 185273) from sender IP address: w.x.y.z. Reverse DNS host verified 1.
14 Oct 2009 08:02:06 (GMT +0800)
(ICID 185273) ACCEPT sender group UNKNOWNLIST match sbrs[-1.0:10.0] SBRS -0.1
14 Oct 2009 08:02:06 (GMT +0800)
Start message 56176 on incoming connection (ICID 185273).
14 Oct 2009 08:02:06 (GMT +0800)
Message 56176 enqueued on incoming connection (ICID 185273) from [email protected]
14 Oct 2009 08:02:06 (GMT +0800)
Message 56176 on incoming connection (ICID 185273) added recipient ([email protected])
14 Oct 2009 08:02:06 (GMT +0800)
Message 56176 on incoming connection (ICID 185273) added recipient ([email protected]).
14 Oct 2009 08:02:08 (GMT +0800)
Incoming connection (ICID 185273) lost.
14 Oct 2009 08:02:08 (GMT +0800)
Message 56176 aborted: Receiving aborted

Do anyone know why it will suddenly lost connection?


Joe Tam

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
dzavasni Thu, 10/15/2009 - 08:54

>>Incoming connection (ICID 185273) lost. <<

This refers to the sending MTA closing/losing the connection. This indicates a problem on the sender's side. Is the issue constant when receiving mail from  ? Or is it an intermittant issue?

AANDOconsultants Fri, 11/06/2009 - 06:57

I am receiving the same error message as above. I appear to only be getting the message when the sender is sending me an attachment. Any ideas on how to correct this?



dzavasni Fri, 11/06/2009 - 08:05

If the Blocker is the one terminating the connection there should be a log as to why it decided to do so. Hopefully finding the transaction in your logs regarding the connection that's being dropped would give you a good starting point. If it is attachment related, I would look into the antivirus logs to see if it is being rejected by the Sophos scan due to potential virus payload. Otherwise, if the sender is receiving a bounce message, the contents of the bounce may give us some insight as to what may be going on.

AANDOconsultants Tue, 11/10/2009 - 08:51

Is there a place in the blocker that limits the size of attachments? The bounceback said something about the message being to big or the receivers mailbox being full. Both of these are set correctly on the server. Any ideas?



You can limit the size of incoming mails in the Mail Flow Policy. The MFP is attached to a Sender Group (SG) in the Host Access Table (HAT). Therefore, you have to find out in which SG the sender will have a match (mail_logs will give you a helping hand doing this). The SGs are first match out: the match is based on the SBRS or the Sender address.




This Discussion