Hi,
In relation to mail processing on the Cisco Email Security Appliance (ESA), some clients disconnect after they get shown the EHLO size limit. Those clients do not send a QUIT, but end the connection perfectly normal on a TCP-base level. In this instance, the ESA will log ICID lost.
This typically happens when either the ESA loses the connection, or the sending client prematurely ends the connection without sending us the entire message. This would mean that the remote host connected but did not send any data.
If you know the sending domain, host name, or IP address, you can take a closer look at this occurrence by enabling Injection Debug logs. This will give you more detailed information during the SMTP conversation. Debug logging can be turned on from the CLI by using logconfig > new, or from the GUI by enabling a new Log Subscription.
You could also set up a packet capture on the appliance for the sender IP to capture details of how the connection is processed.
Thank You!
Libin Varghese
