ubuntuusers.de

Irgendwas mit apparmor oder so aktiv? Läuft der smtp direkt auf dem Rechner oder in nem Container.?

apparmor nutze ich nicht - smtp läuft direkt auf dem Server. Eingerichtet nach folgendem Tutorial: https://thomas-leister.de/mailserver-debian-buster/

Das ist sehr komisch. Teste mal bitte direkt mit ::1 auf dem Server und NICHT mit dem Namen.

Das funktioniert mit 25, 587 und 465.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

RC=1 12:49:13 srv01 ~ $ telnet ::1 25
Trying ::1...
Connected to ::1.
Escape character is '^]'.
220 srv01.domain.de ESMTP Postfix
quit
221 2.0.0 Bye
Connection closed by foreign host.
RC=1 12:49:50 srv01 ~ $ telnet ::1 587
Trying ::1...
Connected to ::1.
Escape character is '^]'.
220 srv01.domain.de ESMTP Postfix
quit
221 2.0.0 Bye
Connection closed by foreign host.
RC=1 12:49:56 srv01 ~ $ telnet ::1 465
Trying ::1...
Connected to ::1.
Escape character is '^]'.
quit
Connection closed by foreign host.

Ebenfalls mit 127.0.0.1 statt ::1

Aber wiederum nicht über PHP.

Dann nimmst du nun einen Netzwerk-Sniffer und schneidest auf lo mit, was da passiert.

Wenn ich dich richtig verstehe geht das dann jetzt in Richtung tcpdump? und zum reproduzieren mach ich in einer zweiten Shell dann wieder die telnets die nicht funktionieren bzw. über PHP?

13:41:19 srv01 ~ $ sudo tcpdump -i lo 'port 25 or port 587 or port 465'
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:41:49.451479 IP localhost.34916 > srv01.domain.de.smtp: Flags [S], seq 3174563642, win 65495, options [mss 65495,sackOK,TS val 2879831734 ecr 0,nop,wscale 7], length 0
13:41:49.451492 IP srv01.domain.de.smtp > localhost.34916: Flags [R.], seq 0, ack 3174563643, win 0, length 0
13:42:01.124305 IP localhost.46810 > srv01.domain.de.submission: Flags [S], seq 1458322933, win 65495, options [mss 65495,sackOK,TS val 2879843407 ecr 0,nop,wscale 7], length 0
13:42:01.124318 IP srv01.domain.de.submission > localhost.46810: Flags [R.], seq 0, ack 1458322934, win 0, length 0
13:42:04.092112 IP localhost.38052 > srv01.domain.de.submissions: Flags [S], seq 3948409936, win 65495, options [mss 65495,sackOK,TS val 2879846375 ecr 0,nop,wscale 7], length 0
13:42:04.092125 IP srv01.domain.de.submissions > localhost.38052: Flags [R.], seq 0, ack 3948409937, win 0, length 0
^C
6 packets captured
12 packets received by filter
0 packets dropped by kernel

13:44:32 srv01 ~ $ sudo tcpdump -i lo
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:44:39.960523 IP localhost.57852 > localhost.redis: Flags [P.], seq 1425310068:1425310082, ack 178179411, win 512, options [nop,nop,TS val 1817288079 ecr 1817277449], length 14: RESP "QUIT"
13:44:39.960722 IP localhost.redis > localhost.57852: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817288080 ecr 1817288079], length 5: RESP "OK"
13:44:39.960744 IP localhost.57852 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960807 IP localhost.redis > localhost.57852: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960938 IP localhost.57852 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960952 IP localhost.redis > localhost.57852: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:40.768717 IP localhost.57910 > localhost.redis: Flags [P.], seq 2196650663:2196650677, ack 3132883522, win 512, options [nop,nop,TS val 1817288888 ecr 1817277449], length 14: RESP "QUIT"
13:44:40.768892 IP localhost.redis > localhost.57910: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 5: RESP "OK"
13:44:40.768905 IP localhost.57910 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.768963 IP localhost.redis > localhost.57910: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.769008 IP localhost.57910 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.769018 IP localhost.redis > localhost.57910: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:41.581451 IP localhost.50922 > srv01.domain.de.smtp: Flags [S], seq 1804678373, win 65495, options [mss 65495,sackOK,TS val 2880003864 ecr 0,nop,wscale 7], length 0
13:44:41.581463 IP srv01.domain.de.smtp > localhost.50922: Flags [R.], seq 0, ack 1804678374, win 0, length 0
13:44:41.619307 IP localhost.57880 > localhost.redis: Flags [P.], seq 2498709257:2498709271, ack 2519688344, win 512, options [nop,nop,TS val 1817289738 ecr 1817277450], length 14: RESP "QUIT"
13:44:41.619415 IP localhost.redis > localhost.57880: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 5: RESP "OK"
13:44:41.619428 IP localhost.57880 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 0
13:44:41.619490 IP localhost.redis > localhost.57880: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 0
13:44:41.619526 IP localhost.57880 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817289739 ecr 1817289738], length 0
13:44:41.619535 IP localhost.redis > localhost.57880: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817289739 ecr 1817289739], length 0
13:44:41.741893 IP localhost.57868 > localhost.redis: Flags [P.], seq 609780946:609780960, ack 1502522257, win 512, options [nop,nop,TS val 1817289861 ecr 1817277449], length 14: RESP "QUIT"
13:44:41.742026 IP localhost.redis > localhost.57868: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 5: RESP "OK"
13:44:41.742039 IP localhost.57868 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742103 IP localhost.redis > localhost.57868: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742151 IP localhost.57868 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742161 IP localhost.redis > localhost.57868: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:42.111306 IP localhost.57896 > localhost.redis: Flags [P.], seq 1407863393:1407863407, ack 733994944, win 512, options [nop,nop,TS val 1817290230 ecr 1817277449], length 14: RESP "QUIT"
13:44:42.111462 IP localhost.redis > localhost.57896: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817290230 ecr 1817290230], length 5: RESP "OK"
13:44:42.111476 IP localhost.57896 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817290230 ecr 1817290230], length 0
13:44:42.111562 IP localhost.redis > localhost.57896: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817290231 ecr 1817290230], length 0
13:44:42.111616 IP localhost.57896 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817290231 ecr 1817290231], length 0
13:44:42.111627 IP localhost.redis > localhost.57896: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817290231 ecr 1817290231], length 0
13:44:43.114265 IP localhost.57918 > localhost.redis: Flags [P.], seq 2166294462:2166294476, ack 3033670863, win 512, options [nop,nop,TS val 1817291233 ecr 1817277450], length 14: RESP "QUIT"
13:44:43.114424 IP localhost.redis > localhost.57918: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 5: RESP "OK"
13:44:43.114439 IP localhost.57918 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 0
13:44:43.114500 IP localhost.redis > localhost.57918: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 0
13:44:43.114533 IP localhost.57918 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817291234 ecr 1817291233], length 0
13:44:43.114542 IP localhost.redis > localhost.57918: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817291234 ecr 1817291234], length 0
13:44:46.714508 IP localhost.40016 > localhost.redis: Flags [S], seq 2203660028, win 65495, options [mss 65495,sackOK,TS val 1817294833 ecr 0,nop,wscale 7], length 0
13:44:46.714529 IP localhost.redis > localhost.40016: Flags [S.], seq 296550543, ack 2203660029, win 65483, options [mss 65495,sackOK,TS val 1817294834 ecr 1817294833,nop,wscale 7], length 0
13:44:46.714546 IP localhost.40016 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714646 IP localhost.40016 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:44:46.714657 IP localhost.redis > localhost.40016: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714783 IP localhost.redis > localhost.40016: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 23: RESP "0" "RS"
13:44:46.714790 IP localhost.40016 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714873 IP localhost.40016 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 39: RESP "HGET" "RS" "learns_ham"
13:44:46.714932 IP localhost.redis > localhost.40016: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 8: RESP "97"
13:44:46.714998 IP localhost.40016 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.715069 IP localhost.redis > localhost.40016: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.715077 IP localhost.40016 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:55.987503 IP localhost.44308 > localhost.redis: Flags [S], seq 278224603, win 65495, options [mss 65495,sackOK,TS val 1817304106 ecr 0,nop,wscale 7], length 0
13:44:55.987523 IP localhost.redis > localhost.44308: Flags [S.], seq 3362989681, ack 278224604, win 65483, options [mss 65495,sackOK,TS val 1817304107 ecr 1817304106,nop,wscale 7], length 0
13:44:55.987539 IP localhost.44308 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987612 IP localhost.44308 > localhost.redis: Flags [P.], seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:44:55.987618 IP localhost.redis > localhost.44308: Flags [.], ack 66, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987820 IP localhost.redis > localhost.44308: Flags [P.], seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 15: RESP "0" empty
13:44:55.987838 IP localhost.44308 > localhost.redis: Flags [.], ack 16, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987963 IP localhost.44308 > localhost.redis: Flags [F.], seq 66, ack 16, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.988046 IP localhost.redis > localhost.44308: Flags [F.], seq 16, ack 67, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.988055 IP localhost.44308 > localhost.redis: Flags [.], ack 17, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:57.526442 IP localhost.44316 > localhost.redis: Flags [S], seq 81945276, win 65495, options [mss 65495,sackOK,TS val 1817305645 ecr 0,nop,wscale 7], length 0
13:44:57.526464 IP localhost.redis > localhost.44316: Flags [S.], seq 2100960520, ack 81945277, win 65483, options [mss 65495,sackOK,TS val 1817305645 ecr 1817305645,nop,wscale 7], length 0
13:44:57.526481 IP localhost.44316 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817305645 ecr 1817305645], length 0
13:44:57.526555 IP localhost.44316 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817305646 ecr 1817305645], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:44:57.526564 IP localhost.redis > localhost.44316: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526677 IP localhost.redis > localhost.44316: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 23: RESP "0" "RS"
13:44:57.526692 IP localhost.44316 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526774 IP localhost.44316 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 39: RESP "HGET" "RS" "learns_ham"
13:44:57.526814 IP localhost.redis > localhost.44316: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 8: RESP "97"
13:44:57.526872 IP localhost.44316 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526921 IP localhost.redis > localhost.44316: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526928 IP localhost.44316 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:45:06.945404 IP localhost.46406 > localhost.redis: Flags [S], seq 1551774797, win 65495, options [mss 65495,sackOK,TS val 1817315064 ecr 0,nop,wscale 7], length 0
13:45:06.945429 IP localhost.redis > localhost.46406: Flags [S.], seq 3725997219, ack 1551774798, win 65483, options [mss 65495,sackOK,TS val 1817315064 ecr 1817315064,nop,wscale 7], length 0
13:45:06.945450 IP localhost.46406 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817315064 ecr 1817315064], length 0
13:45:06.945538 IP localhost.46406 > localhost.redis: Flags [P.], seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817315065 ecr 1817315064], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:45:06.945548 IP localhost.redis > localhost.46406: Flags [.], ack 66, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945630 IP localhost.redis > localhost.46406: Flags [P.], seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 15: RESP "0" empty
13:45:06.945637 IP localhost.46406 > localhost.redis: Flags [.], ack 16, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945724 IP localhost.46406 > localhost.redis: Flags [F.], seq 66, ack 16, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945797 IP localhost.redis > localhost.46406: Flags [F.], seq 16, ack 67, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945807 IP localhost.46406 > localhost.redis: Flags [.], ack 17, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:07.165351 IP localhost.46412 > localhost.redis: Flags [S], seq 2531675042, win 65495, options [mss 65495,sackOK,TS val 1817315284 ecr 0,nop,wscale 7], length 0
13:45:07.165370 IP localhost.redis > localhost.46412: Flags [S.], seq 1164948937, ack 2531675043, win 65483, options [mss 65495,sackOK,TS val 1817315284 ecr 1817315284,nop,wscale 7], length 0
13:45:07.165387 IP localhost.46412 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 0
13:45:07.165463 IP localhost.46412 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:45:07.165471 IP localhost.redis > localhost.46412: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 0
13:45:07.165569 IP localhost.redis > localhost.46412: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817315285 ecr 1817315284], length 23: RESP "0" "RS"
13:45:07.165575 IP localhost.46412 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165652 IP localhost.46412 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 39: RESP "HGET" "RS" "learns_ham"
13:45:07.165709 IP localhost.redis > localhost.46412: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 8: RESP "97"
13:45:07.165758 IP localhost.46412 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165801 IP localhost.redis > localhost.46412: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165808 IP localhost.46412 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0

13:48:18 srv01 ~ $ sudo tcpdump -i lo -v
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:48:22.878613 IP (tos 0x10, ttl 64, id 42837, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.59602 > srv01.domain.de.smtp: Flags [S], cksum 0xff30 (incorrect -> 0x8e99), seq 3683618997, win 65495, options [mss 65495,sackOK,TS val 2880225162 ecr 0,nop,wscale 7], length 0
13:48:22.878625 IP (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    srv01.domain.de.smtp > localhost.59602: Flags [R.], cksum 0x5b9c (correct), seq 0, ack 3683618998, win 0, length 0
13:48:26.760187 IP (tos 0x0, ttl 64, id 50936, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53760 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x5eb9), seq 4003895265, win 65495, options [mss 65495,sackOK,TS val 1817514879 ecr 0,nop,wscale 7], length 0
13:48:26.760211 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53760: Flags [S.], cksum 0xfe30 (incorrect -> 0xd92d), seq 2513268708, ack 4003895266, win 65483, options [mss 65495,sackOK,TS val 1817514879 ecr 1817514879,nop,wscale 7], length 0
13:48:26.760228 IP (tos 0x0, ttl 64, id 50937, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xffe9), ack 1, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760310 IP (tos 0x0, ttl 64, id 50938, offset 0, flags [DF], proto TCP (6), length 116)
    localhost.53760 > localhost.redis: Flags [P.], cksum 0xfe68 (incorrect -> 0xfe9c), seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:48:26.760318 IP (tos 0x0, ttl 64, id 9602, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53760: Flags [.], cksum 0xfe28 (incorrect -> 0xffa9), ack 65, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760488 IP (tos 0x0, ttl 64, id 9603, offset 0, flags [DF], proto TCP (6), length 75)
    localhost.redis > localhost.53760: Flags [P.], cksum 0xfe3f (incorrect -> 0x883e), seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 23: RESP "0" "RS"
13:48:26.760504 IP (tos 0x0, ttl 64, id 50939, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xff92), ack 24, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760575 IP (tos 0x0, ttl 64, id 50940, offset 0, flags [DF], proto TCP (6), length 91)
    localhost.53760 > localhost.redis: Flags [P.], cksum 0xfe4f (incorrect -> 0xe25f), seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817514880 ecr 1817514879], length 39: RESP "HGET" "RS" "learns_ham"
13:48:26.760622 IP (tos 0x0, ttl 64, id 9604, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53760: Flags [P.], cksum 0xfe30 (incorrect -> 0x87dc), seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 8: RESP "97"
13:48:26.760674 IP (tos 0x0, ttl 64, id 50941, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0xff60), seq 104, ack 32, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:26.760733 IP (tos 0x0, ttl 64, id 9605, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53760: Flags [F.], cksum 0xfe28 (incorrect -> 0xff5f), seq 32, ack 105, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:26.760742 IP (tos 0x0, ttl 64, id 50942, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xff5f), ack 33, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:27.405408 IP (tos 0x0, ttl 64, id 33125, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53764 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x70dc), seq 962934903, win 65495, options [mss 65495,sackOK,TS val 1817515524 ecr 0,nop,wscale 7], length 0
13:48:27.405429 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53764: Flags [S.], cksum 0xfe30 (incorrect -> 0xe947), seq 360640439, ack 962934904, win 65483, options [mss 65495,sackOK,TS val 1817515524 ecr 1817515524,nop,wscale 7], length 0
13:48:27.405445 IP (tos 0x0, ttl 64, id 33126, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x1004), ack 1, win 512, options [nop,nop,TS val 1817515524 ecr 1817515524], length 0
13:48:27.405522 IP (tos 0x0, ttl 64, id 33127, offset 0, flags [DF], proto TCP (6), length 116)
    localhost.53764 > localhost.redis: Flags [P.], cksum 0xfe68 (incorrect -> 0x0eb6), seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817515525 ecr 1817515524], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:48:27.405528 IP (tos 0x0, ttl 64, id 58046, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53764: Flags [.], cksum 0xfe28 (incorrect -> 0x0fc2), ack 65, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405708 IP (tos 0x0, ttl 64, id 58047, offset 0, flags [DF], proto TCP (6), length 75)
    localhost.redis > localhost.53764: Flags [P.], cksum 0xfe3f (incorrect -> 0x9856), seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 23: RESP "0" "RS"
13:48:27.405728 IP (tos 0x0, ttl 64, id 33128, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x0fab), ack 24, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405806 IP (tos 0x0, ttl 64, id 33129, offset 0, flags [DF], proto TCP (6), length 91)
    localhost.53764 > localhost.redis: Flags [P.], cksum 0xfe4f (incorrect -> 0xf278), seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 39: RESP "HGET" "RS" "learns_ham"
13:48:27.405859 IP (tos 0x0, ttl 64, id 58048, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53764: Flags [P.], cksum 0xfe30 (incorrect -> 0x97f6), seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 8: RESP "97"
13:48:27.405917 IP (tos 0x0, ttl 64, id 33130, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0x0f7b), seq 104, ack 32, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405980 IP (tos 0x0, ttl 64, id 58049, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53764: Flags [F.], cksum 0xfe28 (incorrect -> 0x0f7a), seq 32, ack 105, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405988 IP (tos 0x0, ttl 64, id 33131, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x0f7a), ack 33, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:29.341317 IP (tos 0x0, ttl 64, id 47836, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53770 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x7fd3), seq 223628795, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341317 IP (tos 0x0, ttl 64, id 62657, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53768 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x4ea4), seq 669213853, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341335 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53768: Flags [S.], cksum 0xfe30 (incorrect -> 0x3070), seq 3735139747, ack 669213854, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341335 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53770: Flags [S.], cksum 0xfe30 (incorrect -> 0xa90a), seq 2875302264, ack 223628796, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341350 IP (tos 0x0, ttl 64, id 62658, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53768 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x572c), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341350 IP (tos 0x0, ttl 64, id 47837, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53770 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xcfc6), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341396 IP (tos 0x0, ttl 64, id 34687, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53776 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x64e7), seq 177105831, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341408 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53776: Flags [S.], cksum 0xfe30 (incorrect -> 0xc2b9), seq 3239335722, ack 177105832, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341419 IP (tos 0x0, ttl 64, id 34688, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xe975), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341430 IP (tos 0x0, ttl 64, id 47838, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53770 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x98ae), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341431 IP (tos 0x0, ttl 64, id 62659, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53768 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x2014), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341436 IP (tos 0x0, ttl 64, id 51552, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53770: Flags [.], cksum 0xfe28 (incorrect -> 0xcf89), ack 62, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341437 IP (tos 0x0, ttl 64, id 4221, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53768: Flags [.], cksum 0xfe28 (incorrect -> 0x56ef), ack 62, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341486 IP (tos 0x0, ttl 64, id 34901, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53792 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x6921), seq 2674250373, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341492 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53792: Flags [S.], cksum 0xfe30 (incorrect -> 0x2e4c), seq 597200206, ack 2674250374, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341500 IP (tos 0x0, ttl 64, id 34902, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53792 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x5508), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341550 IP (tos 0x0, ttl 64, id 11306, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53796 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x9def), seq 4112467960, win 65495, options [mss 65495,sackOK,TS val 1817517461 ecr 0,nop,wscale 7], length 0
13:48:29.341556 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53796: Flags [S.], cksum 0xfe30 (incorrect -> 0x3220), seq 1820554588, ack 4112467961, win 65483, options [mss 65495,sackOK,TS val 1817517461 ecr 1817517461,nop,wscale 7], length 0
13:48:29.341562 IP (tos 0x0, ttl 64, id 11307, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53796 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x58dc), ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341605 IP (tos 0x0, ttl 64, id 4222, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53768: Flags [P.], cksum 0x0ed2 (incorrect -> 0x5f97), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341619 IP (tos 0x0, ttl 64, id 11308, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53796 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x21c4), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341624 IP (tos 0x0, ttl 64, id 61490, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53796: Flags [.], cksum 0xfe28 (incorrect -> 0x589f), ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341631 IP (tos 0x0, ttl 64, id 62660, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53768 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x4659), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341636 IP (tos 0x0, ttl 64, id 34903, offset 0, flags [DF], proto TCP (6), length 158)
    localhost.53792 > localhost.redis: Flags [P.], cksum 0xfe92 (incorrect -> 0x78d1), seq 1:107, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 106: RESP "EVALSHA" "78a9cf8dbdb62c5bd42231ff358ebb0725c2e58a" "2" "rn2_default_1_default" "3"
13:48:29.341642 IP (tos 0x0, ttl 64, id 40108, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53792: Flags [.], cksum 0xfe28 (incorrect -> 0x549d), ack 107, win 511, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341646 IP (tos 0x0, ttl 64, id 51553, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53770: Flags [P.], cksum 0x0ed2 (incorrect -> 0xd831), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341651 IP (tos 0x0, ttl 64, id 34689, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53776 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0xb25c), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341655 IP (tos 0x0, ttl 64, id 64906, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53776: Flags [.], cksum 0xfe28 (incorrect -> 0xe936), ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341659 IP (tos 0x0, ttl 64, id 47839, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53770 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xbef3), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341749 IP (tos 0x0, ttl 64, id 64907, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53776: Flags [P.], cksum 0x0ed2 (incorrect -> 0xf1df), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341766 IP (tos 0x0, ttl 64, id 34690, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xd8a2), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341776 IP (tos 0x0, ttl 64, id 40109, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53792: Flags [P.], cksum 0xfe2c (incorrect -> 0x1d56), seq 1:5, ack 107, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP empty
13:48:29.341780 IP (tos 0x0, ttl 64, id 34904, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53792 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x5498), ack 5, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341803 IP (tos 0x0, ttl 64, id 61491, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53796: Flags [P.], cksum 0x0ed2 (incorrect -> 0x6148), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341808 IP (tos 0x0, ttl 64, id 11309, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53796 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x480b), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342027 IP (tos 0x0, ttl 64, id 19107, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53802 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x9ebc), seq 3368842104, win 65495, options [mss 65495,sackOK,TS val 1817517461 ecr 0,nop,wscale 7], length 0
13:48:29.342035 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53802: Flags [S.], cksum 0xfe30 (incorrect -> 0x6b0d), seq 1147037025, ack 3368842105, win 65483, options [mss 65495,sackOK,TS val 1817517461 ecr 1817517461,nop,wscale 7], length 0
13:48:29.342043 IP (tos 0x0, ttl 64, id 19108, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x91c9), ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342094 IP (tos 0x0, ttl 64, id 19109, offset 0, flags [DF], proto TCP (6), length 142)
    localhost.53802 > localhost.redis: Flags [P.], cksum 0xfe82 (incorrect -> 0xbfb9), seq 1:91, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 90: RESP "HMGET" "rn_default_default_pwqtj511_0" "ann" "roc_thresholds" "pca"
13:48:29.342100 IP (tos 0x0, ttl 64, id 15088, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53802: Flags [.], cksum 0xfe28 (incorrect -> 0x9170), ack 91, win 511, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342146 IP (tos 0x0, ttl 64, id 15089, offset 0, flags [DF], proto TCP (6), length 71)
    localhost.redis > localhost.53802: Flags [P.], cksum 0xfe3b (incorrect -> 0x6143), seq 1:20, ack 91, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 19: RESP null null null
13:48:29.342153 IP (tos 0x0, ttl 64, id 19110, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x915c), ack 20, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342276 IP (tos 0x0, ttl 64, id 34691, offset 0, flags [DF], proto TCP (6), length 112)
    localhost.53776 > localhost.redis: Flags [P.], cksum 0xfe64 (incorrect -> 0x2be2), seq 62:122, ack 4266, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 60: RESP "SCARD" "rn_default_default_pwqtj511_0_spam_set"
13:48:29.342329 IP (tos 0x0, ttl 64, id 64908, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53776: Flags [P.], cksum 0xfe2c (incorrect -> 0x910b), seq 4266:4270, ack 122, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP "0"
13:48:29.342419 IP (tos 0x0, ttl 64, id 19111, offset 0, flags [DF], proto TCP (6), length 111)
    localhost.53802 > localhost.redis: Flags [P.], cksum 0xfe63 (incorrect -> 0xc44e), seq 91:150, ack 20, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 59: RESP "SCARD" "rn_default_default_pwqtj511_0_ham_set"
13:48:29.342464 IP (tos 0x0, ttl 64, id 15090, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53802: Flags [P.], cksum 0xfe2c (incorrect -> 0x49da), seq 20:24, ack 150, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP "1"
13:48:29.385109 IP (tos 0x0, ttl 64, id 19112, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x90f2), ack 24, win 512, options [nop,nop,TS val 1817517504 ecr 1817517461], length 0
13:48:29.385115 IP (tos 0x0, ttl 64, id 34692, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xd822), ack 4270, win 512, options [nop,nop,TS val 1817517504 ecr 1817517461], length 0
13:48:29.815147 IP (tos 0x0, ttl 64, id 40622, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53814 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x24c6), seq 769295996, win 65495, options [mss 65495,sackOK,TS val 1817517934 ecr 0,nop,wscale 7], length 0
13:48:29.815169 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53814: Flags [S.], cksum 0xfe30 (incorrect -> 0xb422), seq 2265275861, ack 769295997, win 65483, options [mss 65495,sackOK,TS val 1817517934 ecr 1817517934,nop,wscale 7], length 0
13:48:29.815185 IP (tos 0x0, ttl 64, id 40623, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xdade), ack 1, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815283 IP (tos 0x0, ttl 64, id 40624, offset 0, flags [DF], proto TCP (6), length 117)
    localhost.53814 > localhost.redis: Flags [P.], cksum 0xfe69 (incorrect -> 0x66a7), seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:48:29.815296 IP (tos 0x0, ttl 64, id 48038, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53814: Flags [.], cksum 0xfe28 (incorrect -> 0xda9d), ack 66, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815404 IP (tos 0x0, ttl 64, id 48039, offset 0, flags [DF], proto TCP (6), length 67)
    localhost.redis > localhost.53814: Flags [P.], cksum 0xfe37 (incorrect -> 0xfdca), seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 15: RESP "0" empty
13:48:29.815410 IP (tos 0x0, ttl 64, id 40625, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xda8e), ack 16, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815513 IP (tos 0x0, ttl 64, id 40626, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0xda8c), seq 66, ack 16, win 512, options [nop,nop,TS val 1817517935 ecr 1817517934], length 0
13:48:29.815574 IP (tos 0x0, ttl 64, id 48040, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53814: Flags [F.], cksum 0xfe28 (incorrect -> 0xda8a), seq 16, ack 67, win 512, options [nop,nop,TS val 1817517935 ecr 1817517935], length 0
13:48:29.815583 IP (tos 0x0, ttl 64, id 40627, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xda8a), ack 17, win 512, options [nop,nop,TS val 1817517935 ecr 1817517935], length 0

13:42:01.124305 IP localhost.46810 > srv01.domain.de.submission: Flags [S], seq 1458322933, win 65495, options [mss 65495,sackOK,TS val 2879843407 ecr 0,nop,wscale 7], length 0

Warum geht der auf submission? Das ist für einen MSA wie Thunderbird mit Auth gedacht. PHP darf nur den Port 25 nutzen.

Ich habe alle 3 einmal durchgespielt im ersten dump.

port 25

13:41:49.451479 IP localhost.34916 > srv01.domain.de.smtp: Flags [S], seq 3174563642, win 65495, options [mss 65495,sackOK,TS val 2879831734 ecr 0,nop,wscale 7], length 0
13:41:49.451492 IP srv01.domain.de.smtp > localhost.34916: Flags [R.], seq 0, ack 3174563643, win 0, length 0

port 587

13:42:01.124305 IP localhost.46810 > srv01.domain.de.submission: Flags [S], seq 1458322933, win 65495, options [mss 65495,sackOK,TS val 2879843407 ecr 0,nop,wscale 7], length 0
13:42:01.124318 IP srv01.domain.de.submission > localhost.46810: Flags [R.], seq 0, ack 1458322934, win 0, length 0

port 465

13:42:04.092112 IP localhost.38052 > srv01.domain.de.submissions: Flags [S], seq 3948409936, win 65495, options [mss 65495,sackOK,TS val 2879846375 ecr 0,nop,wscale 7], length 0
13:42:04.092125 IP srv01.domain.de.submissions > localhost.38052: Flags [R.], seq 0, ack 3948409937, win 0, length 0

Die dumps darunter sind alle nur Port 25.

Du musst verhindern dass 465/587 genutzt werden. Dann machen wir weiter.

Kannst du mir das näher erläutern?

Diese tcpdumps nutzen ausschließlich port 25:

13:44:32 srv01 ~ $ sudo tcpdump -i lo
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:44:39.960523 IP localhost.57852 > localhost.redis: Flags [P.], seq 1425310068:1425310082, ack 178179411, win 512, options [nop,nop,TS val 1817288079 ecr 1817277449], length 14: RESP "QUIT"
13:44:39.960722 IP localhost.redis > localhost.57852: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817288080 ecr 1817288079], length 5: RESP "OK"
13:44:39.960744 IP localhost.57852 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960807 IP localhost.redis > localhost.57852: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960938 IP localhost.57852 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:39.960952 IP localhost.redis > localhost.57852: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817288080 ecr 1817288080], length 0
13:44:40.768717 IP localhost.57910 > localhost.redis: Flags [P.], seq 2196650663:2196650677, ack 3132883522, win 512, options [nop,nop,TS val 1817288888 ecr 1817277449], length 14: RESP "QUIT"
13:44:40.768892 IP localhost.redis > localhost.57910: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 5: RESP "OK"
13:44:40.768905 IP localhost.57910 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.768963 IP localhost.redis > localhost.57910: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.769008 IP localhost.57910 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:40.769018 IP localhost.redis > localhost.57910: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817288888 ecr 1817288888], length 0
13:44:41.581451 IP localhost.50922 > srv01.domain.de.smtp: Flags [S], seq 1804678373, win 65495, options [mss 65495,sackOK,TS val 2880003864 ecr 0,nop,wscale 7], length 0
13:44:41.581463 IP srv01.domain.de.smtp > localhost.50922: Flags [R.], seq 0, ack 1804678374, win 0, length 0
13:44:41.619307 IP localhost.57880 > localhost.redis: Flags [P.], seq 2498709257:2498709271, ack 2519688344, win 512, options [nop,nop,TS val 1817289738 ecr 1817277450], length 14: RESP "QUIT"
13:44:41.619415 IP localhost.redis > localhost.57880: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 5: RESP "OK"
13:44:41.619428 IP localhost.57880 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 0
13:44:41.619490 IP localhost.redis > localhost.57880: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817289738 ecr 1817289738], length 0
13:44:41.619526 IP localhost.57880 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817289739 ecr 1817289738], length 0
13:44:41.619535 IP localhost.redis > localhost.57880: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817289739 ecr 1817289739], length 0
13:44:41.741893 IP localhost.57868 > localhost.redis: Flags [P.], seq 609780946:609780960, ack 1502522257, win 512, options [nop,nop,TS val 1817289861 ecr 1817277449], length 14: RESP "QUIT"
13:44:41.742026 IP localhost.redis > localhost.57868: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 5: RESP "OK"
13:44:41.742039 IP localhost.57868 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742103 IP localhost.redis > localhost.57868: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742151 IP localhost.57868 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:41.742161 IP localhost.redis > localhost.57868: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817289861 ecr 1817289861], length 0
13:44:42.111306 IP localhost.57896 > localhost.redis: Flags [P.], seq 1407863393:1407863407, ack 733994944, win 512, options [nop,nop,TS val 1817290230 ecr 1817277449], length 14: RESP "QUIT"
13:44:42.111462 IP localhost.redis > localhost.57896: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817290230 ecr 1817290230], length 5: RESP "OK"
13:44:42.111476 IP localhost.57896 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817290230 ecr 1817290230], length 0
13:44:42.111562 IP localhost.redis > localhost.57896: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817290231 ecr 1817290230], length 0
13:44:42.111616 IP localhost.57896 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817290231 ecr 1817290231], length 0
13:44:42.111627 IP localhost.redis > localhost.57896: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817290231 ecr 1817290231], length 0
13:44:43.114265 IP localhost.57918 > localhost.redis: Flags [P.], seq 2166294462:2166294476, ack 3033670863, win 512, options [nop,nop,TS val 1817291233 ecr 1817277450], length 14: RESP "QUIT"
13:44:43.114424 IP localhost.redis > localhost.57918: Flags [P.], seq 1:6, ack 14, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 5: RESP "OK"
13:44:43.114439 IP localhost.57918 > localhost.redis: Flags [.], ack 6, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 0
13:44:43.114500 IP localhost.redis > localhost.57918: Flags [F.], seq 6, ack 14, win 512, options [nop,nop,TS val 1817291233 ecr 1817291233], length 0
13:44:43.114533 IP localhost.57918 > localhost.redis: Flags [F.], seq 14, ack 7, win 512, options [nop,nop,TS val 1817291234 ecr 1817291233], length 0
13:44:43.114542 IP localhost.redis > localhost.57918: Flags [.], ack 15, win 512, options [nop,nop,TS val 1817291234 ecr 1817291234], length 0
13:44:46.714508 IP localhost.40016 > localhost.redis: Flags [S], seq 2203660028, win 65495, options [mss 65495,sackOK,TS val 1817294833 ecr 0,nop,wscale 7], length 0
13:44:46.714529 IP localhost.redis > localhost.40016: Flags [S.], seq 296550543, ack 2203660029, win 65483, options [mss 65495,sackOK,TS val 1817294834 ecr 1817294833,nop,wscale 7], length 0
13:44:46.714546 IP localhost.40016 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714646 IP localhost.40016 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:44:46.714657 IP localhost.redis > localhost.40016: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714783 IP localhost.redis > localhost.40016: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 23: RESP "0" "RS"
13:44:46.714790 IP localhost.40016 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.714873 IP localhost.40016 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 39: RESP "HGET" "RS" "learns_ham"
13:44:46.714932 IP localhost.redis > localhost.40016: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 8: RESP "97"
13:44:46.714998 IP localhost.40016 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.715069 IP localhost.redis > localhost.40016: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:46.715077 IP localhost.40016 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817294834 ecr 1817294834], length 0
13:44:55.987503 IP localhost.44308 > localhost.redis: Flags [S], seq 278224603, win 65495, options [mss 65495,sackOK,TS val 1817304106 ecr 0,nop,wscale 7], length 0
13:44:55.987523 IP localhost.redis > localhost.44308: Flags [S.], seq 3362989681, ack 278224604, win 65483, options [mss 65495,sackOK,TS val 1817304107 ecr 1817304106,nop,wscale 7], length 0
13:44:55.987539 IP localhost.44308 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987612 IP localhost.44308 > localhost.redis: Flags [P.], seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:44:55.987618 IP localhost.redis > localhost.44308: Flags [.], ack 66, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987820 IP localhost.redis > localhost.44308: Flags [P.], seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 15: RESP "0" empty
13:44:55.987838 IP localhost.44308 > localhost.redis: Flags [.], ack 16, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.987963 IP localhost.44308 > localhost.redis: Flags [F.], seq 66, ack 16, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.988046 IP localhost.redis > localhost.44308: Flags [F.], seq 16, ack 67, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:55.988055 IP localhost.44308 > localhost.redis: Flags [.], ack 17, win 512, options [nop,nop,TS val 1817304107 ecr 1817304107], length 0
13:44:57.526442 IP localhost.44316 > localhost.redis: Flags [S], seq 81945276, win 65495, options [mss 65495,sackOK,TS val 1817305645 ecr 0,nop,wscale 7], length 0
13:44:57.526464 IP localhost.redis > localhost.44316: Flags [S.], seq 2100960520, ack 81945277, win 65483, options [mss 65495,sackOK,TS val 1817305645 ecr 1817305645,nop,wscale 7], length 0
13:44:57.526481 IP localhost.44316 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817305645 ecr 1817305645], length 0
13:44:57.526555 IP localhost.44316 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817305646 ecr 1817305645], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:44:57.526564 IP localhost.redis > localhost.44316: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526677 IP localhost.redis > localhost.44316: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 23: RESP "0" "RS"
13:44:57.526692 IP localhost.44316 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526774 IP localhost.44316 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 39: RESP "HGET" "RS" "learns_ham"
13:44:57.526814 IP localhost.redis > localhost.44316: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 8: RESP "97"
13:44:57.526872 IP localhost.44316 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526921 IP localhost.redis > localhost.44316: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:44:57.526928 IP localhost.44316 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817305646 ecr 1817305646], length 0
13:45:06.945404 IP localhost.46406 > localhost.redis: Flags [S], seq 1551774797, win 65495, options [mss 65495,sackOK,TS val 1817315064 ecr 0,nop,wscale 7], length 0
13:45:06.945429 IP localhost.redis > localhost.46406: Flags [S.], seq 3725997219, ack 1551774798, win 65483, options [mss 65495,sackOK,TS val 1817315064 ecr 1817315064,nop,wscale 7], length 0
13:45:06.945450 IP localhost.46406 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817315064 ecr 1817315064], length 0
13:45:06.945538 IP localhost.46406 > localhost.redis: Flags [P.], seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817315065 ecr 1817315064], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:45:06.945548 IP localhost.redis > localhost.46406: Flags [.], ack 66, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945630 IP localhost.redis > localhost.46406: Flags [P.], seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 15: RESP "0" empty
13:45:06.945637 IP localhost.46406 > localhost.redis: Flags [.], ack 16, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945724 IP localhost.46406 > localhost.redis: Flags [F.], seq 66, ack 16, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945797 IP localhost.redis > localhost.46406: Flags [F.], seq 16, ack 67, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:06.945807 IP localhost.46406 > localhost.redis: Flags [.], ack 17, win 512, options [nop,nop,TS val 1817315065 ecr 1817315065], length 0
13:45:07.165351 IP localhost.46412 > localhost.redis: Flags [S], seq 2531675042, win 65495, options [mss 65495,sackOK,TS val 1817315284 ecr 0,nop,wscale 7], length 0
13:45:07.165370 IP localhost.redis > localhost.46412: Flags [S.], seq 1164948937, ack 2531675043, win 65483, options [mss 65495,sackOK,TS val 1817315284 ecr 1817315284,nop,wscale 7], length 0
13:45:07.165387 IP localhost.46412 > localhost.redis: Flags [.], ack 1, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 0
13:45:07.165463 IP localhost.46412 > localhost.redis: Flags [P.], seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:45:07.165471 IP localhost.redis > localhost.46412: Flags [.], ack 65, win 512, options [nop,nop,TS val 1817315284 ecr 1817315284], length 0
13:45:07.165569 IP localhost.redis > localhost.46412: Flags [P.], seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817315285 ecr 1817315284], length 23: RESP "0" "RS"
13:45:07.165575 IP localhost.46412 > localhost.redis: Flags [.], ack 24, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165652 IP localhost.46412 > localhost.redis: Flags [P.], seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 39: RESP "HGET" "RS" "learns_ham"
13:45:07.165709 IP localhost.redis > localhost.46412: Flags [P.], seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 8: RESP "97"
13:45:07.165758 IP localhost.46412 > localhost.redis: Flags [F.], seq 104, ack 32, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165801 IP localhost.redis > localhost.46412: Flags [F.], seq 32, ack 105, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0
13:45:07.165808 IP localhost.46412 > localhost.redis: Flags [.], ack 33, win 512, options [nop,nop,TS val 1817315285 ecr 1817315285], length 0

13:48:18 srv01 ~ $ sudo tcpdump -i lo -v
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:48:22.878613 IP (tos 0x10, ttl 64, id 42837, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.59602 > srv01.domain.de.smtp: Flags [S], cksum 0xff30 (incorrect -> 0x8e99), seq 3683618997, win 65495, options [mss 65495,sackOK,TS val 2880225162 ecr 0,nop,wscale 7], length 0
13:48:22.878625 IP (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    srv01.domain.de.smtp > localhost.59602: Flags [R.], cksum 0x5b9c (correct), seq 0, ack 3683618998, win 0, length 0
13:48:26.760187 IP (tos 0x0, ttl 64, id 50936, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53760 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x5eb9), seq 4003895265, win 65495, options [mss 65495,sackOK,TS val 1817514879 ecr 0,nop,wscale 7], length 0
13:48:26.760211 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53760: Flags [S.], cksum 0xfe30 (incorrect -> 0xd92d), seq 2513268708, ack 4003895266, win 65483, options [mss 65495,sackOK,TS val 1817514879 ecr 1817514879,nop,wscale 7], length 0
13:48:26.760228 IP (tos 0x0, ttl 64, id 50937, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xffe9), ack 1, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760310 IP (tos 0x0, ttl 64, id 50938, offset 0, flags [DF], proto TCP (6), length 116)
    localhost.53760 > localhost.redis: Flags [P.], cksum 0xfe68 (incorrect -> 0xfe9c), seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:48:26.760318 IP (tos 0x0, ttl 64, id 9602, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53760: Flags [.], cksum 0xfe28 (incorrect -> 0xffa9), ack 65, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760488 IP (tos 0x0, ttl 64, id 9603, offset 0, flags [DF], proto TCP (6), length 75)
    localhost.redis > localhost.53760: Flags [P.], cksum 0xfe3f (incorrect -> 0x883e), seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 23: RESP "0" "RS"
13:48:26.760504 IP (tos 0x0, ttl 64, id 50939, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xff92), ack 24, win 512, options [nop,nop,TS val 1817514879 ecr 1817514879], length 0
13:48:26.760575 IP (tos 0x0, ttl 64, id 50940, offset 0, flags [DF], proto TCP (6), length 91)
    localhost.53760 > localhost.redis: Flags [P.], cksum 0xfe4f (incorrect -> 0xe25f), seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817514880 ecr 1817514879], length 39: RESP "HGET" "RS" "learns_ham"
13:48:26.760622 IP (tos 0x0, ttl 64, id 9604, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53760: Flags [P.], cksum 0xfe30 (incorrect -> 0x87dc), seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 8: RESP "97"
13:48:26.760674 IP (tos 0x0, ttl 64, id 50941, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0xff60), seq 104, ack 32, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:26.760733 IP (tos 0x0, ttl 64, id 9605, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53760: Flags [F.], cksum 0xfe28 (incorrect -> 0xff5f), seq 32, ack 105, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:26.760742 IP (tos 0x0, ttl 64, id 50942, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53760 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xff5f), ack 33, win 512, options [nop,nop,TS val 1817514880 ecr 1817514880], length 0
13:48:27.405408 IP (tos 0x0, ttl 64, id 33125, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53764 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x70dc), seq 962934903, win 65495, options [mss 65495,sackOK,TS val 1817515524 ecr 0,nop,wscale 7], length 0
13:48:27.405429 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53764: Flags [S.], cksum 0xfe30 (incorrect -> 0xe947), seq 360640439, ack 962934904, win 65483, options [mss 65495,sackOK,TS val 1817515524 ecr 1817515524,nop,wscale 7], length 0
13:48:27.405445 IP (tos 0x0, ttl 64, id 33126, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x1004), ack 1, win 512, options [nop,nop,TS val 1817515524 ecr 1817515524], length 0
13:48:27.405522 IP (tos 0x0, ttl 64, id 33127, offset 0, flags [DF], proto TCP (6), length 116)
    localhost.53764 > localhost.redis: Flags [P.], cksum 0xfe68 (incorrect -> 0x0eb6), seq 1:65, ack 1, win 512, options [nop,nop,TS val 1817515525 ecr 1817515524], length 64: RESP "SSCAN" "BAYES_HAM_keys" "0" "COUNT" "1000"
13:48:27.405528 IP (tos 0x0, ttl 64, id 58046, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53764: Flags [.], cksum 0xfe28 (incorrect -> 0x0fc2), ack 65, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405708 IP (tos 0x0, ttl 64, id 58047, offset 0, flags [DF], proto TCP (6), length 75)
    localhost.redis > localhost.53764: Flags [P.], cksum 0xfe3f (incorrect -> 0x9856), seq 1:24, ack 65, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 23: RESP "0" "RS"
13:48:27.405728 IP (tos 0x0, ttl 64, id 33128, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x0fab), ack 24, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405806 IP (tos 0x0, ttl 64, id 33129, offset 0, flags [DF], proto TCP (6), length 91)
    localhost.53764 > localhost.redis: Flags [P.], cksum 0xfe4f (incorrect -> 0xf278), seq 65:104, ack 24, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 39: RESP "HGET" "RS" "learns_ham"
13:48:27.405859 IP (tos 0x0, ttl 64, id 58048, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53764: Flags [P.], cksum 0xfe30 (incorrect -> 0x97f6), seq 24:32, ack 104, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 8: RESP "97"
13:48:27.405917 IP (tos 0x0, ttl 64, id 33130, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0x0f7b), seq 104, ack 32, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405980 IP (tos 0x0, ttl 64, id 58049, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53764: Flags [F.], cksum 0xfe28 (incorrect -> 0x0f7a), seq 32, ack 105, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:27.405988 IP (tos 0x0, ttl 64, id 33131, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53764 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x0f7a), ack 33, win 512, options [nop,nop,TS val 1817515525 ecr 1817515525], length 0
13:48:29.341317 IP (tos 0x0, ttl 64, id 47836, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53770 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x7fd3), seq 223628795, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341317 IP (tos 0x0, ttl 64, id 62657, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53768 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x4ea4), seq 669213853, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341335 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53768: Flags [S.], cksum 0xfe30 (incorrect -> 0x3070), seq 3735139747, ack 669213854, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341335 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53770: Flags [S.], cksum 0xfe30 (incorrect -> 0xa90a), seq 2875302264, ack 223628796, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341350 IP (tos 0x0, ttl 64, id 62658, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53768 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x572c), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341350 IP (tos 0x0, ttl 64, id 47837, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53770 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xcfc6), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341396 IP (tos 0x0, ttl 64, id 34687, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53776 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x64e7), seq 177105831, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341408 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53776: Flags [S.], cksum 0xfe30 (incorrect -> 0xc2b9), seq 3239335722, ack 177105832, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341419 IP (tos 0x0, ttl 64, id 34688, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xe975), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341430 IP (tos 0x0, ttl 64, id 47838, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53770 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x98ae), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341431 IP (tos 0x0, ttl 64, id 62659, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53768 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x2014), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341436 IP (tos 0x0, ttl 64, id 51552, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53770: Flags [.], cksum 0xfe28 (incorrect -> 0xcf89), ack 62, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341437 IP (tos 0x0, ttl 64, id 4221, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53768: Flags [.], cksum 0xfe28 (incorrect -> 0x56ef), ack 62, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341486 IP (tos 0x0, ttl 64, id 34901, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53792 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x6921), seq 2674250373, win 65495, options [mss 65495,sackOK,TS val 1817517460 ecr 0,nop,wscale 7], length 0
13:48:29.341492 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53792: Flags [S.], cksum 0xfe30 (incorrect -> 0x2e4c), seq 597200206, ack 2674250374, win 65483, options [mss 65495,sackOK,TS val 1817517460 ecr 1817517460,nop,wscale 7], length 0
13:48:29.341500 IP (tos 0x0, ttl 64, id 34902, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53792 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x5508), ack 1, win 512, options [nop,nop,TS val 1817517460 ecr 1817517460], length 0
13:48:29.341550 IP (tos 0x0, ttl 64, id 11306, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53796 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x9def), seq 4112467960, win 65495, options [mss 65495,sackOK,TS val 1817517461 ecr 0,nop,wscale 7], length 0
13:48:29.341556 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53796: Flags [S.], cksum 0xfe30 (incorrect -> 0x3220), seq 1820554588, ack 4112467961, win 65483, options [mss 65495,sackOK,TS val 1817517461 ecr 1817517461,nop,wscale 7], length 0
13:48:29.341562 IP (tos 0x0, ttl 64, id 11307, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53796 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x58dc), ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341605 IP (tos 0x0, ttl 64, id 4222, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53768: Flags [P.], cksum 0x0ed2 (incorrect -> 0x5f97), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341619 IP (tos 0x0, ttl 64, id 11308, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53796 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0x21c4), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341624 IP (tos 0x0, ttl 64, id 61490, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53796: Flags [.], cksum 0xfe28 (incorrect -> 0x589f), ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341631 IP (tos 0x0, ttl 64, id 62660, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53768 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x4659), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341636 IP (tos 0x0, ttl 64, id 34903, offset 0, flags [DF], proto TCP (6), length 158)
    localhost.53792 > localhost.redis: Flags [P.], cksum 0xfe92 (incorrect -> 0x78d1), seq 1:107, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 106: RESP "EVALSHA" "78a9cf8dbdb62c5bd42231ff358ebb0725c2e58a" "2" "rn2_default_1_default" "3"
13:48:29.341642 IP (tos 0x0, ttl 64, id 40108, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53792: Flags [.], cksum 0xfe28 (incorrect -> 0x549d), ack 107, win 511, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341646 IP (tos 0x0, ttl 64, id 51553, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53770: Flags [P.], cksum 0x0ed2 (incorrect -> 0xd831), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341651 IP (tos 0x0, ttl 64, id 34689, offset 0, flags [DF], proto TCP (6), length 113)
    localhost.53776 > localhost.redis: Flags [P.], cksum 0xfe65 (incorrect -> 0xb25c), seq 1:62, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517460], length 61: RESP "ZREVRANGE" "rn2_default_1_default" "0" "3"
13:48:29.341655 IP (tos 0x0, ttl 64, id 64906, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53776: Flags [.], cksum 0xfe28 (incorrect -> 0xe936), ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341659 IP (tos 0x0, ttl 64, id 47839, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53770 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xbef3), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341749 IP (tos 0x0, ttl 64, id 64907, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53776: Flags [P.], cksum 0x0ed2 (incorrect -> 0xf1df), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341766 IP (tos 0x0, ttl 64, id 34690, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xd8a2), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341776 IP (tos 0x0, ttl 64, id 40109, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53792: Flags [P.], cksum 0xfe2c (incorrect -> 0x1d56), seq 1:5, ack 107, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP empty
13:48:29.341780 IP (tos 0x0, ttl 64, id 34904, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53792 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x5498), ack 5, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.341803 IP (tos 0x0, ttl 64, id 61491, offset 0, flags [DF], proto TCP (6), length 4317)
    localhost.redis > localhost.53796: Flags [P.], cksum 0x0ed2 (incorrect -> 0x6148), seq 1:4266, ack 62, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4265: RESP "{"digest":"pwqtj511wrmhxjegtr8eq5k4t1rngrwa1hyadkow6613f1d8hzqjr9n7j5iardhmiewumj5y1hz1uua1y8qy84676m77639cw4j3msb","symbols":["ARC_SIGNED","BITCOIN_ADDR","BLACKLIST_FROM","BLACKLIST_IP","BOGUS_ENCRYPTED_AND_TEXT","BOUNCE","BROKEN_CONTENT_TYPE","BROKEN_HEADERS","CC_EXCESS_BASE64","CC_EXCESS_QP","CTE_CASE","CTYPE_MISSING_DISPOSITION","CTYPE_MIXED_BOGUS","CT_EXTRA_SEMI","DATA_URI_OBFU","DISPOSABLE_CC","DISPOSABLE_ENVFROM","DISPOSABLE_ENVRCPT","DISPOSABLE_FROM","DISPOSABLE_REPLYTO","DISPOSABLE_TO","DKIM_SIGNED","EMPTY_SUBJECT","ENVFROM_PRVS","ENVFROM_SERVICE_ACCT","ENVFROM_VERP","EXT_CSS","FAKE_RECEIVED_mail_ru","FAKE_RECEIVED_smtp_yandex_ru","FAKE_REPLY","FORGED_GENERIC_RECEIVED","FORGED_GENERIC_RECEIVED2","FORGED_GENERIC_RECEIVED3","FORGED_GENERIC_RECEIVED4","FORGED_IMS","FORGED_MSGID_YAHOO","FORGED_MUA_KMAIL_MSGID_UNKNOWN","FORGED_MUA_MOZILLA_MAIL_MSGID","FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN","FORGED_MUA_OPERA_MSGID","FORGED_MUA_OUTLOOK","FORGED_MUA_POSTBOX_MSGID","FORGED_MUA_POSTBOX_MSGID_UNKNOWN","FORGED_MUA_SEAMONKEY_MSGID","FORGED_MUA_SEAMONKEY_MSGID_UNKNOWN","FORGED_MUA_THEBAT_BOUN","FORGED_MUA_THEBAT_MSGID","FORGED_MUA_THEBAT_MSGID_UNKNOWN","FORGED_MUA_THUNDERBIRD_MSGID","FORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN","FORGED_OUTLOOK_HTML","FORGED_OUTLOOK_TAGS","FORGED_X_MAILER","FORWARDED","FREEMAIL_CC","FREEMAIL_ENVFROM","FREEMAIL_ENVRCPT","FREEMAIL_FROM","FREEMAIL_REPLYTO","FREEMAIL_REPLYTO_NEQ_FROM_DOM","FREEMAIL_TO","FROM_EXCESS_BASE64","FROM_EXCESS_QP","FROM_NEEDS_ENCODING","FROM_SERVICE_ACCT","FUZZY_DENIED","FUZZY_PROB","FUZZY_UNKNOWN","FUZZY_WHITE","FWD_GOOGLE","FWD_MAILRU","FWD_SRS","FWD_YANDEX","GOOGLE_FORWARDING_MID_BROKEN","GOOGLE_FORWARDING_MID_MISSING","HAS_ATTACHMENT","HAS_DATA_URI","HAS_GOOGLE_REDIR","HAS_GUC_PROXY_URI","HAS_INTERSPIRE_SIG","HAS_LIST_UNSUB","HAS_ONION_URI","HAS_ORG_HEADER","HAS_PHPMAILER_SIG","HAS_WP_URI","HAS_XAW","HAS_XOIP","HAS_X_ANTIABUSE","HAS_X_AS","HAS_X_GMSV","HAS_X_PHP_SCRIPT","HAS_X_POS","HAS_X_SOURCE","HEADER_CC_EMPTY_DELIMITER","HEADER_DATE_EMPTY_DELIMITER","HEADER_FORGED_MDN","HEADER_FROM_EMPTY_DELIMITER","HEADER_RCONFIRM_MISMATCH","HEADER_REPLYTO_EMPTY_DELIMITER","HEADER_TO_EMPTY_DELIMITER","HIDDEN_SOURCE_OBJ","HTML_META_REFRESH_URL","HTML_SHORT_LINK_IMG_1","HTML_SHORT_LINK_IMG_2","HTML_SHORT_LINK_IMG_3","HTTP_TO_HTTPS","HTTP_TO_IP","INFO_TO_INFO_LU","INTRODUCTION","INVALID_FROM_8BIT","INVALID_MSGID","INVALID_POSTFIX_RECEIVED","INVALID_RCPT_8BIT","KLMS_SPAM","LEAKED_PASSWORD_SCAM_RE","LONG_SUBJ","MAILER_1C_8","MAILLIST","MAIL_RU_MAILER","MICROSOFT_SPAM","MID_RHS_WWW","MIME_BASE64_TEXT","MIME_BASE64_TEXT_BOGUS","MIME_GOOD","MIME_HEADER_CTYPE_ONLY","MIME_HTML_ONLY","MISSING_FROM","MISSING_MID","MISSING_MIMEOLE","MISSING_SUBJECT","MISSING_TO","MULTIPLE_FROM","MULTIPLE_UNIQUE_HEADERS","MV_CASE","OLD_X_MAILER","OMOGRAPH_URL","ONCE_RECEIVED","PHISHING","PHP_SCRIPT_ROOT","PHP_XPS_PATTERN","PRECEDENCE_BULK","PREVIOUSLY_DELIVERED","RATWARE_MS_HASH","RCVD_DOUBLE_IP_SPAM","RCVD_HELO_USER","RCVD_ILLEGAL_CHARS","REPLYTO_EXCESS_BASE64","REPLYTO_EXCESS_QP","REPTO_QUOTE_YAHOO","R_BAD_CTE_7BIT","R_DKIM_ALLOW","R_DKIM_NA","R_DKIM_PERMFAIL","R_DKIM_REJECT","R_DKIM_TEMPFAIL","R_EMPTY_IMAGE","R_MISSING_CHARSET","R_MIXED_CHARSET","R_MIXED_CHARSET_URL","R_NO_SPACE_IN_FROM","R_PARTS_DIFFER","R_RCVD_SPAMBOTS","R_SUSPICIOUS_IMAGES","R_SUSPICIOUS_URL","R_UNDISC_RCPT","SORTED_RECIPS","SPAM_FLAG","SPOOF_REPLYTO","STOX_REPLY_TYPE","STRONGMAIL","SUBJECT_ENDS_EXCLAIM","SUBJECT_ENDS_QUESTION","SUBJECT_ENDS_SPACES","SUBJECT_HAS_CURRENCY","SUBJECT_HAS_EXCLAIM","SUBJECT_HAS_QUESTION","SUBJECT_NEEDS_ENCODING","SUBJ_ALL_CAPS","SUBJ_BOUNCE_WORDS","SUBJ_EXCESS_BASE64","SUBJ_EXCESS_QP","SUSPICIOUS_BOUNDARY","SUSPICIOUS_BOUNDARY2","SUSPICIOUS_BOUNDARY3","SUSPICIOUS_BOUNDARY4","SUSPICIOUS_RECIPS","TO_EXCESS_BASE64","TO_EXCESS_QP","TO_NEEDS_ENCODING","TO_WRAPPED_IN_SPACES","TRACKER_ID","UNITEDINTERNET_SPAM","URI_COUNT_ODD","URI_HIDDEN_PATH","URL_IN_SUBJECT","WHITELIST_DKIM","WHITELIST_DMARC","WHITELIST_FROM","WHITELIST_IP","WHITELIST_SPF","WHITELIST_SPF_DKIM","WP_COMPROMISED","WWW_DOT_DOMAIN","XAW_SERVICE_ACCT","XM_CASE","XM_UA_NO_VERSION","X_PHPOS_FAKE","X_PHP_EVAL","X_PHP_FORGED_0X","YANDEX_RU_MAILER"],"version":0,"distance":0,"redis_key":"rn_default_default_pwqtj511_0"}"
13:48:29.341808 IP (tos 0x0, ttl 64, id 11309, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53796 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x480b), ack 4266, win 491, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342027 IP (tos 0x0, ttl 64, id 19107, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53802 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x9ebc), seq 3368842104, win 65495, options [mss 65495,sackOK,TS val 1817517461 ecr 0,nop,wscale 7], length 0
13:48:29.342035 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53802: Flags [S.], cksum 0xfe30 (incorrect -> 0x6b0d), seq 1147037025, ack 3368842105, win 65483, options [mss 65495,sackOK,TS val 1817517461 ecr 1817517461,nop,wscale 7], length 0
13:48:29.342043 IP (tos 0x0, ttl 64, id 19108, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x91c9), ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342094 IP (tos 0x0, ttl 64, id 19109, offset 0, flags [DF], proto TCP (6), length 142)
    localhost.53802 > localhost.redis: Flags [P.], cksum 0xfe82 (incorrect -> 0xbfb9), seq 1:91, ack 1, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 90: RESP "HMGET" "rn_default_default_pwqtj511_0" "ann" "roc_thresholds" "pca"
13:48:29.342100 IP (tos 0x0, ttl 64, id 15088, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53802: Flags [.], cksum 0xfe28 (incorrect -> 0x9170), ack 91, win 511, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342146 IP (tos 0x0, ttl 64, id 15089, offset 0, flags [DF], proto TCP (6), length 71)
    localhost.redis > localhost.53802: Flags [P.], cksum 0xfe3b (incorrect -> 0x6143), seq 1:20, ack 91, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 19: RESP null null null
13:48:29.342153 IP (tos 0x0, ttl 64, id 19110, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x915c), ack 20, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 0
13:48:29.342276 IP (tos 0x0, ttl 64, id 34691, offset 0, flags [DF], proto TCP (6), length 112)
    localhost.53776 > localhost.redis: Flags [P.], cksum 0xfe64 (incorrect -> 0x2be2), seq 62:122, ack 4266, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 60: RESP "SCARD" "rn_default_default_pwqtj511_0_spam_set"
13:48:29.342329 IP (tos 0x0, ttl 64, id 64908, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53776: Flags [P.], cksum 0xfe2c (incorrect -> 0x910b), seq 4266:4270, ack 122, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP "0"
13:48:29.342419 IP (tos 0x0, ttl 64, id 19111, offset 0, flags [DF], proto TCP (6), length 111)
    localhost.53802 > localhost.redis: Flags [P.], cksum 0xfe63 (incorrect -> 0xc44e), seq 91:150, ack 20, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 59: RESP "SCARD" "rn_default_default_pwqtj511_0_ham_set"
13:48:29.342464 IP (tos 0x0, ttl 64, id 15090, offset 0, flags [DF], proto TCP (6), length 56)
    localhost.redis > localhost.53802: Flags [P.], cksum 0xfe2c (incorrect -> 0x49da), seq 20:24, ack 150, win 512, options [nop,nop,TS val 1817517461 ecr 1817517461], length 4: RESP "1"
13:48:29.385109 IP (tos 0x0, ttl 64, id 19112, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53802 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0x90f2), ack 24, win 512, options [nop,nop,TS val 1817517504 ecr 1817517461], length 0
13:48:29.385115 IP (tos 0x0, ttl 64, id 34692, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53776 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xd822), ack 4270, win 512, options [nop,nop,TS val 1817517504 ecr 1817517461], length 0
13:48:29.815147 IP (tos 0x0, ttl 64, id 40622, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.53814 > localhost.redis: Flags [S], cksum 0xfe30 (incorrect -> 0x24c6), seq 769295996, win 65495, options [mss 65495,sackOK,TS val 1817517934 ecr 0,nop,wscale 7], length 0
13:48:29.815169 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    localhost.redis > localhost.53814: Flags [S.], cksum 0xfe30 (incorrect -> 0xb422), seq 2265275861, ack 769295997, win 65483, options [mss 65495,sackOK,TS val 1817517934 ecr 1817517934,nop,wscale 7], length 0
13:48:29.815185 IP (tos 0x0, ttl 64, id 40623, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xdade), ack 1, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815283 IP (tos 0x0, ttl 64, id 40624, offset 0, flags [DF], proto TCP (6), length 117)
    localhost.53814 > localhost.redis: Flags [P.], cksum 0xfe69 (incorrect -> 0x66a7), seq 1:66, ack 1, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 65: RESP "SSCAN" "BAYES_SPAM_keys" "0" "COUNT" "1000"
13:48:29.815296 IP (tos 0x0, ttl 64, id 48038, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53814: Flags [.], cksum 0xfe28 (incorrect -> 0xda9d), ack 66, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815404 IP (tos 0x0, ttl 64, id 48039, offset 0, flags [DF], proto TCP (6), length 67)
    localhost.redis > localhost.53814: Flags [P.], cksum 0xfe37 (incorrect -> 0xfdca), seq 1:16, ack 66, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 15: RESP "0" empty
13:48:29.815410 IP (tos 0x0, ttl 64, id 40625, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xda8e), ack 16, win 512, options [nop,nop,TS val 1817517934 ecr 1817517934], length 0
13:48:29.815513 IP (tos 0x0, ttl 64, id 40626, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [F.], cksum 0xfe28 (incorrect -> 0xda8c), seq 66, ack 16, win 512, options [nop,nop,TS val 1817517935 ecr 1817517934], length 0
13:48:29.815574 IP (tos 0x0, ttl 64, id 48040, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.redis > localhost.53814: Flags [F.], cksum 0xfe28 (incorrect -> 0xda8a), seq 16, ack 67, win 512, options [nop,nop,TS val 1817517935 ecr 1817517935], length 0
13:48:29.815583 IP (tos 0x0, ttl 64, id 40627, offset 0, flags [DF], proto TCP (6), length 52)
    localhost.53814 > localhost.redis: Flags [.], cksum 0xfe28 (incorrect -> 0xda8a), ack 17, win 512, options [nop,nop,TS val 1817517935 ecr 1817517935], length 0

https://docs.hetzner.com/de/cloud/servers/faq#warum-kann-ich-keine-mails-von-meinem-server-verschicken

...

mal schauen obs das ist...

Nope...Das ist es auch nicht.

Also aktueller Fakt: - von extern kein Thema - lokal ist das Problem

Ich kann dir da bei Postfix auch nicht weiterhelfen.