JK> 11:35:36.666699 IP (tos 0x0, ttl 44, id 23787, offset 0, flags [none], JK> proto TC P (6), length 55) JK> 71.30.81.243.23 > 72.43.242.234.41035 JK> Telnet: JK> 0x0000: fffb 03 WILL SUPPRESS GO AHEAD
Ok, I see IAC WILL 03 here (IAC == Interpret As Command) from the called side.
JK> 11:35:36.739953 IP (tos 0x0, ttl 44, id 23788, offset 0, flags [none], JK> proto TC P (6), length 70) JK> 71.30.81.243.23 > 72.43.242.234.41035: JK> Telnet: JK> 0x0000: fffb 00 WILL BINARY JK> 0x0003: fffb 00 WILL BINARY JK> 0x0006: fffd 00 DO BINARY JK> 0x0009: fffd 03 DO SUPPRESS GO AHEAD JK> 0x000c: fffd 18 DO TERMINAL TYPE JK> 0x000f: fffb 01 WILL ECHO
Here I see even more options from the called side...
JK> 11:35:36.967000 IP (tos 0x0, ttl 64, id 51401, offset 0, flags [DF], JK> proto TCP (6 ), length 55) JK> 72.43.242.234.41035 > 71.30.81.243.23: JK> Telnet: JK> 0x0000: fffb 18 WILL TERMINAL TYPE
The calling side tells it will run in a fully bi-directional mode issuing select() on a connection socket every time when idle to check for data...
JK> 11:35:37.039568 IP (tos 0x0, ttl 44, id 23790, offset 0, flags [none], JK> proto TC P (6), length 58) JK> 71.30.81.243.23 > 72.43.242.234.41035: JK> Telnet: JK> 0x0000: fffa 1801 fff0 SB TERMINAL TYPE SEND SE
One more option from the called side... However, all these options: 1. are not related to each other (I guess, they are ignored by recipient) 2. appear only in "virtual modem" hadshake phase
Here goes usual EMSI handshake performed my mailers, without any Telnet sequences.
I'd like to ask you to perform a bit less trivial test: try to transfer a file containing 20...30 bytes with value 0xFF (and record the session with tcpdump, of course). If my suggestion is correct, that would prove telnet sequences are added by the FOSSIL layer, not by mailer.
-- Alexey V. Vissarionov aka Gremlin from Kremlin gremlin.ru!gremlin; +vii-cmiii-ccxxix-lxxix-xlii
