Below is a sample output from tcpdump. 192.99.7.175 is the remote IP address.
08:42:29.735857 IP 5.103.132.90.smtp > 192.99.7.175.46466: Flags [P.], seq 1384180636:1384180670, ack 219308459, win 115, length 34
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 004a 0134 4000 4006 e7a4 0567 845a c063 .J.4@.@....g.Z.c
0x0020: 07af 0019 b582 5280 eb9c 0d12 61ab 5018 ......R.....a.P.
0x0030: 0073 5210 0000 3232 3020 6b61 726f 6c69 .sR...220.karoli
0x0040: 6e65 2e69 6273 6761 6172 6465 6e2e 646b ne.ibsgaarden.dk
0x0050: 2045 534d 5450 0d0a .ESMTP..
08:42:29.831910 IP 192.99.7.175.46466 > 5.103.132.90.smtp: Flags [P.], seq 1:15, ack 34, win 256, length 14
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4502 ....Uy..../@..E.
0x0010: 0036 5635 4000 6906 69b7 c063 07af 0567 .6V5@.i.i..c...g
0x0020: 845a b582 0019 0d12 61ab 5280 ebbe 5018 .Z......a.R...P.
0x0030: 0100 5049 0000 4548 4c4f 2055 4a54 4f73 ..PI..EHLO.UJTOs
0x0040: 514b 0d0a QK..
08:42:29.832016 IP 5.103.132.90.smtp > 192.99.7.175.46466: Flags [.], ack 15, win 115, length 0
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4500 ..../@....Uy..E.
0x0010: 0028 0135 4000 4006 e7c7 0567 845a c063 .(.5@.@....g.Z.c
0x0020: 07af 0019 b582 5280 ebbe 0d12 61b9 5010 ......R.....a.P.
0x0030: 0073 fae7 0000 .s....
08:42:29.834926 IP 5.103.132.90.smtp > 192.99.7.175.46466: Flags [P.], seq 34:159, ack 15, win 115, length 125
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 00a5 0136 4000 4006 e747 0567 845a c063 ...6@.@..G.g.Z.c
0x0020: 07af 0019 b582 5280 ebbe 0d12 61b9 5018 ......R.....a.P.
0x0030: 0073 526b 0000 3235 302d 6962 7367 6161 .sRk..250-ibsgaa
0x0040: 7264 656e 2e64 6b20 4869 206e 7335 3038 rden.dk.Hi.ns508
0x0050: 3037 332e 6970 2d31 3932 2d39 392d 372e 073.ip-192-99-7.
0x0060: 6e65 7420 5b31 3932 2e39 392e 372e 3137 net.[192.99.7.17
0x0070: 355d 0d0a 3235 302d 5049 5045 4c49 4e49 5]..250-PIPELINI
0x0080: 4e47 0d0a 3235 302d 3842 4954 4d49 4d45 NG..250-8BITMIME
0x0090: 0d0a 3235 302d 5349 5a45 2035 3030 3030 ..250-SIZE.50000
0x00a0: 3030 300d 0a32 3530 2053 5441 5254 544c 000..250.STARTTL
0x00b0: 530d 0a S..
08:42:29.951556 IP 192.99.7.175.46466 > 5.103.132.90.smtp: Flags [P.], seq 15:27, ack 159, win 256, length 12
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4502 ....Uy..../@..E.
0x0010: 0034 5636 4000 6906 69b8 c063 07af 0567 .4V6@.i.i..c...g
0x0020: 845a b582 0019 0d12 61b9 5280 ec3b 5018 .Z......a.R..;P.
0x0030: 0100 9e40 0000 4155 5448 204c 4f47 494e ...@..AUTH.LOGIN
0x0040: 0d0a ..
08:42:29.952540 IP 5.103.132.90.smtp > 192.99.7.175.46466: Flags [P.], seq 159:185, ack 27, win 115, length 26
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 0042 0137 4000 4006 e7a9 0567 845a c063 .B.7@.@....g.Z.c
0x0020: 07af 0019 b582 5280 ec3b 0d12 61c5 5018 ......R..;..a.P.
0x0030: 0073 5208 0000 3530 3020 556e 7265 636f .sR...500.Unreco
0x0040: 676e 697a 6564 2063 6f6d 6d61 6e64 0d0a gnized.command..
08:42:30.048946 IP 192.99.7.175.46466 > 5.103.132.90.smtp: Flags [F.], seq 27, ack 185, win 255, length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0028 5637 4000 6906 69c5 c063 07af 0567 .(V7@.i.i..c...g
0x0020: 845a b582 0019 0d12 61c5 5280 ec55 5011 .Z......a.R..UP.
0x0030: 00ff f9b7 0000 0000 0000 0000 ............
08:42:30.067676 IP 5.103.132.90.smtp > 192.99.7.175.46466: Flags [F.], seq 185, ack 28, win 115, length 0
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4500 ..../@....Uy..E.
0x0010: 0028 0138 4000 4006 e7c4 0567 845a c063 .(.8@.@....g.Z.c
0x0020: 07af 0019 b582 5280 ec55 0d12 61c6 5011 ......R..U..a.P.
0x0030: 0073 fa42 0000 .s.B..
08:42:30.132882 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [SEW], seq 4153497208, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0034 5638 4000 6a06 68b8 c063 07af 0567 .4V8@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5678 0000 0000 80c2 .Z......Vx......
0x0030: 2000 c497 0000 0204 05b4 0103 0308 0101 ................
0x0040: 0402 ..
08:42:30.132960 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [S.E], seq 359390978, ack 4153497209, win 14600, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4500 ..../@....Uy..E.
0x0010: 0034 0000 4000 4006 e8f0 0567 845a c063 .4..@.@....g.Z.c
0x0020: 07af 0019 e9c1 156b df02 f791 5679 8052 .......k....Vy.R
0x0030: 3908 b791 0000 0204 05b4 0101 0402 0103 9...............
0x0040: 0307 ..
08:42:30.163693 IP 192.99.7.175.46466 > 5.103.132.90.smtp: Flags [.], ack 186, win 255, length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0028 5639 4000 6906 69c3 c063 07af 0567 .(V9@.i.i..c...g
0x0020: 845a b582 0019 0d12 61c6 5280 ec56 5010 .Z......a.R..VP.
0x0030: 00ff f9b6 0000 0000 0000 0000 ............
08:42:30.233249 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [.], ack 1, win 256, length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0028 563a 4000 6a06 68c2 c063 07af 0567 .(V:@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5679 156b df03 5010 .Z......Vy.k..P.
0x0030: 0100 30ac 0000 0000 0000 0000 ..0.........
08:42:31.623741 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [P.], seq 1:35, ack 1, win 115, length 34
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 004a 2d04 4000 4006 bbd4 0567 845a c063 .J-.@.@....g.Z.c
0x0020: 07af 0019 e9c1 156b df03 f791 5679 5018 .......k....VyP.
0x0030: 0073 5210 0000 3232 3020 6b61 726f 6c69 .sR...220.karoli
0x0040: 6e65 2e69 6273 6761 6172 6465 6e2e 646b ne.ibsgaarden.dk
0x0050: 2045 534d 5450 0d0a .ESMTP..
08:42:31.724155 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [P.], seq 1:17, ack 35, win 256, length 16
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0038 563b 4000 6a06 68b1 c063 07af 0567 .8V;@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5679 156b df25 5018 .Z......Vy.k.%P.
0x0030: 0100 d9b3 0000 4548 4c4f 2066 6578 6b66 ......EHLO.fexkf
0x0040: 5962 6d75 0d0a Ybmu..
08:42:31.724261 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [.], ack 17, win 115, length 0
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4500 ..../@....Uy..E.
0x0010: 0028 2d05 4000 4006 bbf7 0567 845a c063 .(-.@.@....g.Z.c
0x0020: 07af 0019 e9c1 156b df25 f791 5689 5010 .......k.%..V.P.
0x0030: 0073 3107 0000 .s1...
08:42:31.727179 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [P.], seq 35:160, ack 17, win 115, length 125
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 00a5 2d06 4000 4006 bb77 0567 845a c063 ..-.@.@..w.g.Z.c
0x0020: 07af 0019 e9c1 156b df25 f791 5689 5018 .......k.%..V.P.
0x0030: 0073 526b 0000 3235 302d 6962 7367 6161 .sRk..250-ibsgaa
0x0040: 7264 656e 2e64 6b20 4869 206e 7335 3038 rden.dk.Hi.ns508
0x0050: 3037 332e 6970 2d31 3932 2d39 392d 372e 073.ip-192-99-7.
0x0060: 6e65 7420 5b31 3932 2e39 392e 372e 3137 net.[192.99.7.17
0x0070: 355d 0d0a 3235 302d 5049 5045 4c49 4e49 5]..250-PIPELINI
0x0080: 4e47 0d0a 3235 302d 3842 4954 4d49 4d45 NG..250-8BITMIME
0x0090: 0d0a 3235 302d 5349 5a45 2035 3030 3030 ..250-SIZE.50000
0x00a0: 3030 300d 0a32 3530 2053 5441 5254 544c 000..250.STARTTL
0x00b0: 530d 0a S..
08:42:31.827647 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [P.], seq 17:29, ack 160, win 256, length 12
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0034 563c 4000 6a06 68b4 c063 07af 0567 .4V<@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5689 156b dfa2 5018 .Z......V..k..P.
0x0030: 0100 d45f 0000 4155 5448 204c 4f47 494e ..._..AUTH.LOGIN
0x0040: 0d0a ..
08:42:31.828641 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [P.], seq 160:186, ack 29, win 115, length 26
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4502 ..../@....Uy..E.
0x0010: 0042 2d07 4000 4006 bbd9 0567 845a c063 .B-.@.@....g.Z.c
0x0020: 07af 0019 e9c1 156b dfa2 f791 5695 5018 .......k....V.P.
0x0030: 0073 5208 0000 3530 3020 556e 7265 636f .sR...500.Unreco
0x0040: 676e 697a 6564 2063 6f6d 6d61 6e64 0d0a gnized.command..
08:42:31.929098 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [F.], seq 29, ack 186, win 255, length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0028 563d 4000 6a06 68bf c063 07af 0567 .(V=@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5695 156b dfbc 5011 .Z......V..k..P.
0x0030: 00ff 2fd7 0000 0000 0000 0000 ../.........
08:42:31.947704 IP 5.103.132.90.smtp > 192.99.7.175.59841: Flags [F.], seq 186, ack 30, win 115, length 0
0x0000: 0008 ae8a 2f40 009c 0297 5579 0800 4500 ..../@....Uy..E.
0x0010: 0028 2d08 4000 4006 bbf4 0567 845a c063 .(-.@.@....g.Z.c
0x0020: 07af 0019 e9c1 156b dfbc f791 5696 5011 .......k....V.P.
0x0030: 0073 3062 0000 .s0b..
08:42:32.048059 IP 192.99.7.175.59841 > 5.103.132.90.smtp: Flags [.], ack 187, win 255, length 0
0x0000: 009c 0297 5579 0008 ae8a 2f40 0800 4500 ....Uy..../@..E.
0x0010: 0028 563e 4000 6a06 68be c063 07af 0567 .(V>@.j.h..c...g
0x0020: 845a e9c1 0019 f791 5696 156b dfbd 5010 .Z......V..k..P.
0x0030: 00ff 2fd6 0000 0000 0000 0000 ../.........
Does this give a clue about the problem?
Kind regards,
Jesper