technical help with e-mail

[anonaconda]

Can someone help me with the inner workings of mail? I'm getting corrupted attachments which I don't believe to be the fault of my system, but I would like to be sure.

Consider the following example (fake names of course):

Mail with .XLS attachment is sent:
From- sender@source.com
To- first@sink.com; second@sink.com

On different days, first & second open their own Outlook on their own workstations and each downloads her copy of the mail.

The XLS received by first & second both have the same corruption rendering it unreadable. The two corrupted XLS are IDENTICAL at the bit level when checked with a hex editor.

The POP3 is at our service provider (Bluewin, Switzerland) - we don't have a local mail server.

Where in the chain is the LAST place that this shared identical corruption could happen? I don't see how it can be my systemthat messes up exactly the same packets in exactly the same way

And yes, this is really happening to me: it happened in Outlook, I switched to Outlook-Express and it still happens.

Thanks 'conda

[cyberskye]

Does this happen with all attachments or only those of large size or or a certain filetype?

[YeOldeStonecat]

A couple of times I've seen problems regarding attatchments with e-mail...only when a LAN is behind a broadband router. I ran into this with one of the first hundred Linksys routers that rolled onto the market years ago, hooking up my first DSL routed network. Ended up being related to MTU...which you had to fix software wise back then, newer firmware supports adjusting it at the router. Now and then I find some networks need MTU fiddled with. I generally max it out, or somewhere around 1492/1500.

Don't know if you're on broadband or not....

[anonaconda]

Thanks for the replies. Answering both questions:

--cyberskye--

Not all the mails. This is my wife's office: each time she reports dead attachments I bombard her & her colleague with a standard set of mails with 5k, 50k, 500k files attached - they all work.

She's receives dead .XLS and dead .PDF from time to time.

Today's message which prompted my question included 4 x XLS of 100...120kb: first two worked fine, third was recoverable with tools & effort, fourth was DEAD DEAD DEAD.



--YeOldeStonecat --

Routing is obscure/strange:

-ISP pop3 to...
(via leased-line)
-neighbour's router to...
(via 10mbps LAN)
-LINUX ipchains firewall to...
(via 100mbps LAN)
-NT4 private-LAN which hosts the workstations.


Thanks for your thoughts, 'conda.

[cyberskye]

I was thinking that macros or other executionary (my new favorite word) might be getting filtered somewhere allong the way. Are you running application-level filters?

As for your topology - there are a lot of variables in there that would make YOSC's theory difficult to test out. I would if you are able. Odd, still, that it affects only certain file types.

Skye

[anonaconda]

There are no filters running. Under Outlook there were anti-porn and anti-junk "rules", and we used the freebie CA virus checker. Currently O-Express has no "rules" and there is no real-time virus checking while I try to diagnose this mess. The LINUX box runs only ipchains firewalling and ipmasq NAT

The worrying point is that two different people get the same mail with PRECISELY the same corruption even though they download from the POP3 on different days.

I can accept that packets get re-assembled incorrectly occasionally, but I can't believe that EXACTLY the same misfortune can happen to two independent mail files at different times. Am I wrong?

I'm trying to understand at which stage in the sender-receiver chain the one-file (one mail to two people) splits up and becomes two-files (a mail for each addressee).

For this bit-level-identical corruption to occur it seems to me more logical that it happens at the one-file stage than the two-file stage. I want to believe that this corruption is happening at the POP3 or earlier. Am I wrong here too?

This office receives around 150 XLS and 50 PDF each month - of these 200 attachments maybe 10 or 15 are dead. Each mail may have 1.....6 attachments. Corruption is more common when there are multiple attachments and tends to hit the last attachments worse than the first attachment.
There are three different senders (completely independent - different companies, domains, software, countries), one sends only PDF, the other two only XLS. Corruption is most common from one of the XLS senders and the PDF sender.
One other symptom is that the PDF sender copies addresses on other domains - these other addresses do NOT see the same corruption i.e. the message is not corrupted when the sender hits the "send" button.

I've tried every kind of test message from three different ISPs and cannot trigger the corruption.

Desperate! 'conda

[zxc47]

I think I would run a up to date virus scan .with something like mcafee . sound like a virus

[cyberskye]

This office receives around 150 XLS and 50 PDF each month - of these 200 attachments maybe 10 or 15 are dead. Each mail may have 1.....6 attachments. Corruption is more common when there are multiple attachments and tends to hit the last attachments worse than the first attachment

Almost sounds like someone is hitting a size limit. Hope someone can come along and procide a solution for you. I would starting sending everything zipped. Zipped files are rarely inspected themselves (only way I can send myself and exe at work) and woudl reduce the size of either format (xls and pdf)


God luck,

skye