Hi all,
I'm pulling my hair out on this problem and wanted to throw it out there to see if anyone else had run across it.

I recently restarted my server. There were some network config issues that caused the interfaces not to come back up, but my colo company got those resolved.

However, after restart, my IMAPS server has stopped responding to outside requests.  I can successfully access IMAP from localhost, as well as via SSH tunnelling, so I know it is working.

I've tried all sorts of "listen=" configurations, and checked lsof & tcpdump to rule out other problems, but it just seems as though dovecot isn't responding.

TCPDUMP (notice the TCP SYN but no response):
/var/log 89# tcpdump -vvs 192 port 993
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 192 bytes
17:37:54.101518 IP (tos 0x0, ttl 112, id 56543, offset 0, flags [DF], length: 48) c-24-9-151-115.hsd1.co.comcast.net.3132 > mail.server.com.imaps: S [tcp sum ok] 1828791628:1828791628(0) win 16384 <mss 1460,nop,nop,sackOK>
17:37:58.282840 IP (tos 0x0, ttl  59, id 54721, offset 0, flags [DF], length: 60) dsl001-148-165.sfo1.dsl.speakeasy.net.39250 > mail.server.com.imaps: S [tcp sum ok] 3827175783:3827175783(0) win 5840 <mss 1460,sackOK,timestamp 1555809446 0,nop,wscale 2>
17:38:00.130267 IP (tos 0x0, ttl 112, id 56548, offset 0, flags [DF], length: 48) c-24-9-151-115.hsd1.co.comcast.net.3132 > mail.server.com.imaps: S [tcp sum ok] 1828791628:1828791628(0) win 16384 <mss 1460,nop,nop,sackOK>
17:38:01.283013 IP (tos 0x0, ttl  59, id 54722, offset 0, flags [DF], length: 60) dsl001-148-165.sfo1.dsl.speakeasy.net.39250 > mail.server.com.imaps: S [tcp sum ok] 3827175783:3827175783(0) win 5840 <mss 1460,sackOK,timestamp 1555810196 0,nop,wscale 2>


LSOF:
/var/log 91# lsof -i | grep imap
sshd      4475   andrew   11u  IPv4  39601       TCP localhost:34661->localhost:imaps (ESTABLISHED)
dovecot   6540     root    5u  IPv4  38988       TCP *:imaps (LISTEN)
imap-logi 6599  dovecot    9u  IPv4  39602       TCP localhost:imaps->localhost:34661 (ESTABLISHED)
imap-logi 6629  dovecot    1u  IPv4  38988       TCP *:imaps (LISTEN)
imap-logi 6630  dovecot    1u  IPv4  38988       TCP *:imaps (LISTEN)



NETSTAT:
/var/log 92# netstat -an | grep 993
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:993           127.0.0.1:34661         ESTABLISHED
tcp        0      0 127.0.0.1:34661         127.0.0.1:993           ESTABLISHED


STRACE:
17:00:33.225030 gettimeofday({1171501233, 225048}, {480, 0}) = 0
17:00:33.225072 gettimeofday({1171501233, 225090}, NULL) = 0
17:00:33.225113 poll([{fd=7, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=10, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=1, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}], 4, 0) = 0
17:00:33.225163 gettimeofday({1171501233, 225182}, {480, 0}) = 0
17:00:33.225212 gettimeofday({1171501233, 225230}, NULL) = 0
17:00:33.225260 poll([{fd=7, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=10, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=1, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}], 4, 999) = 0
17:00:34.225145 gettimeofday({1171501234, 225179}, {480, 0}) = 0
17:00:34.225204 gettimeofday({1171501234, 225222}, NULL) = 0
17:00:34.225246 poll([{fd=7, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=10, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}, {fd=1, events=POLLIN|POLLPRI|POLLERR|POLLHUP|POLLNVAL}], 4, 0) = 0
17:00:34.225297 gettimeofday({1171501234, 225315}, {480, 0}) = 0



Has anyone seen this behavior? What's the obvious thing I'm missing here?  My host has some weird VLAN thing installed by the colo company so I have IP aliases, but given I'm not even seeing a response to the SYN, it doesn't seem to be a routing issue, and I can connect to my local interface on port 993 (NOT localhost) without problems.

Suggestions much appreciated, I'm stuck.  I'm sure this is something obvious and simple, but I'm looking past it right now.

Andrew

--
Email: andrew@50degreescorp.com