I am looking at my SMTP logs. The script I just run tells me that one of our mail servers has sent 19848kb, and received 386kb. This is pretty weird as this server should just be forwarding on mail that it received.
One of the sources out outbound traffic I noticed is for lines to do with the DATE command. For instance, this line:
11/16/11 00:26:57 SMTP-OU 8AA56F43369C40ECBE07D7A805617D74.MAI 1184 [ipAddress] DATE 250 2.0.0 OK 1321403130 v50si13351192wec.51 172503 45
DATE is the command. 250 2.0.0 OK 1321403130 v50si13351192wec.51 is the response to the command. 172503 is the number of bytes sent, and 45 is the number of bytes received.
I can’t find the specification of what this command does. Is it something like Data-extended? It can’t be transmitting just the calender-date, because it is too big for that.
There is no DATE command in SMTP. I guess they are using this word only in the log, to mark the second part of the DATA conversation. I mean the fist part is:
DATA
354 go on
The second part is:
… the actual data …
250 OK