What does a socket error mean in the GWAVA SMTP log?

Document ID:7019720
Creation Date:30-Apr-2010
Modified Date:07-Aug-2017
- Micro Focus Products:
  GWAVA (Secure Messaging Gateway)

Environment

GWAVA 4/4.51 using an SMTP scanner

Situation

What is a socket error as seen in a GWAVA SMTP log?

Resolution

1) Socket

A socket, in basic terms, is the combination of an IP address and a port that will be used for bidirectional communication. An internet connection is established when two computers are connected via a socket (combination of IPs and ports that will be used to communicate between the two machines).

2) Socket errors

Any sort of socket error simply means that during the communication between the two computers something went wrong. The most common example is that the other computer or server disconnected prematurely. When this happens you will see one of the following errors in the SMTP log.

<ln>2q9u2t0<l>1</l><d>2010-APR-23</d><t>00:00:03</t>Socket read error: TCP recv fail</ln>
<ln>2oht6t0<l>1</l><d>2010-APR-23</d><t>00:00:07</t>Socket read error: TCP session closed</ln>
This could mean that we took too long to respond and the connection timed out or they simply didn't want to continue communicating. A very common example of the other side not wanting to continue communicating is after they have received a message saying that we are not going to receive the connection any further.

<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>+++Scan thread Count is: 10 for 122.174.89.231</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>> process_xml <gwava><scan><prepare><nofile></nofile></prepare></scan></gwava></ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>< 200 Scanner ready</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>Sending SMTP IP address to GWAVA scanner</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>Sending IP address 122.174.89.231 to check reputation</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>Running IP Reputation check</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>< 200 eventtest complete</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>Querying GWAVA for blocking results</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>< 300 Query results ready to send</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>IP reputation Reference id: 0001.0A020301.4BD11B43.01B3</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:03</t>IP reputation result for 122.174.89.231: reject</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:03</t>=> 550 Message was blocked by server (IP reputation hit: 122.174.89.231)</ln>
<ln>2lnvmt0<l>1</l><d>2010-APR-23</d><t>00:00:04</t>Socket is closed</ln>
<ln>2lnvmt0<l>1</l><d>2010-APR-23</d><t>00:00:04</t>Socket read error: TCP recv fail</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:04</t>> PROCESS_XML <gwava><scan><runservice><service><identity>connection_drop</identity></service></runservice></scan></gwava></ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:04</t>> 200 Postprocessing complete</ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:04</t>> process_xml <gwava><scan><finish /></scan></gwava></ln>
<ln>2lnvmt0<l>4</l><d>2010-APR-23</d><t>00:00:04</t>< 200 Scanner process completed</ln>
<ln>2lnvmt0<l>2</l><d>2010-APR-23</d><t>00:00:04</t>Client disconnected from 122.174.89.231</ln>
<ln>2lnvmt0<l>3</l><d>2010-APR-23</d><t>00:00:04</t>---Exiting thread 10</ln>
In the previous log example the sending server was just told that we were not going to receive the message they were going to try and send due to them being on the IP reputation blacklist. Once a sending server realizes that they can't send their message they will either properly end the communication with the SMTP QUIT command or they will just close the socket. Spammers commonly don't follow the SMTP specifications and will just drop the connection as seen in the previous log example.

Additional Information

This article was originally published in the GWAVA knowledgebase as article ID 1696.