Member Avatar for chaze

Do you know how I can see who is connecting so much to my smtp so much? It's centos 4.5 linux host dwhs and it runs cpanel

Here is the error:

421 Too many concurrent SMTP connections; please try again later

  • 3 Contributors
  • 2 Replies
  • 148 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by Darkflib

Dani AI

Generated

As pointed out, the mail server logs are where you correlate who is connecting; and 's idea about inspecting connection tracking is useful for real‑time spotting. Practical workflow: (1) identify active connections, (2) aggregate offending IPs, (3) cross‑check MTA logs/queue for senders, (4) apply temporary blocks or persistent controls.

Quick commands to spot live offenders (run as root):

# legacy netstat method: count remote IPs connected to SMTP
netstat -anp | grep ':25 ' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

# faster alternative with ss
ss -tnp | grep ':25' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head

# inspect established sockets and owning processes
lsof -iTCP:25 -sTCP:ESTABLISHED -nP

Use a short tcpdump capture to inspect session contents (HELO/EHLO, MAIL FROM) and confirm whether connections are spam/automated clients:

tcpdump -n -s 0 -c 200 port 25

On cPanel systems the Exim utilities (exigrep, eximstats, exim -bp to view queue) help map IPs to accounts and messages. If you find a compromised account or script, suspend it and rotate credentials.

Immediate mitigations:

  • Block obvious abusers with iptables:
    iptables -I INPUT -p tcp --dport 25 -s 1.2.3.4 -j DROP
  • Rate‑limit new SMTP connections per IP with connlimit:
    iptables -I INPUT -p tcp --dport 25 --syn -m connlimit --connlimit-above 20 -j REJECT

Longer term: enforce submission on port 587 with authentication, enable throttling in Exim/WHM (Exim Configuration Manager), and run an automated blocker (fail2ban or CSF/LFD). Test any firewall rule carefully and whitelist known upstream MTAs to avoid blocking legitimate mail.

Recommended Answers

All 2 Replies

Member Avatar for DimaYasny

/var/log/mail or whatever logging path your MTA uses

Member Avatar for Darkflib

iptstate might also be able to point you to the culprit.

Iptstate allows you to look at the iptables connection tracking table and see what connections are currently being seen by iptables.

You must have the iptables conn_track module installed to use it, which is pretty common.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.