420 TCP Read errors on GWIA when using Lightspeed spam filter

  • 7007689
  • 26-Jan-2011
  • 27-Apr-2012

Environment

Novell GroupWise 7
Novell GroupWise 8
Novell GroupWise Internet Agent

Situation

GWIA statistics and log files show a large number of "420 TCP Read" errors
Customer using Lightspeed spam filter for incoming email

Resolution

Most spam filters perform a "store-and-forward" filter where they accept an incoming message and then forward it to GWIA only if is not determined to be spam. 

Lightspeed was configured to do "real-time" spam filtering, where it would pass data packets back and forth between GWIA and the sending SMTP server only up to the point where Lightspeed detected that the message was spam.  At that point, Lightspeed would immediately send a RST packet to GWIA to kill the connection.

Because GWIA had received part of the message from the sending SMTP server (and was expecting to receive the rest of the message), when Lightspeed resets the connection in the middle of the SMTP transaction, GWIA reports the "420 TCP Read" error because it was waiting to receive (or read) more data that never arrived because the connection was reset.

Resolution - Contact Lightspeed to see if there is a way to configure Lightspeed to perform store-and-forward message filtering.