Email stopped flowing in this morning - can't figure out why

Microsoft Windows

Running SBS 2003 Premium, ISA 2004, Exchange, WSUS, 2 NIC's and a router,
dynamic IP through ISP, DDNS service through dyndns.org.
============================
For unknown reasons, we stopped getting inbound email about mid-morning. We
can send fine and receive email from within the LAN. I was not working on
the server at the time. Nothing remarkable in the Event Viewer.
I've rerun CEICW 3 times, re-strarted all the Exchange services 2 twice and
even re-started the server. Same results. (I use www.dnsreport.com) --
mail.whoopingcrane.org. - 70.41.130.208 [Could not connect: Could not
receive data: Winsock error #10054.]Any suggestions?
Hello,

If mail.whoopingcrane.org is your servers DNS name, I tried to telnet in
on port 25 and could not. Have you changed anything in the router ?

Have you tried to restartthe Simple Mail Transport Protocol in services
?

Do you have any anti virus or spam that received email on 25 and
forwards to Exchange ?

Of the 5 attempts I made, one looked like it connected but either it was
not exchange (as it did not give me an introduction banner) or it ran so
slow it dumped me out.
To fully answer your questions ....

Changed nothing in the router.

I use Symantec Corporate A/V on the server, plus a trial version of GFIWeb
Monitor, and Windows Defender.

Mike
Well, I hadn't thought to stop/start SMTP (should have know that), so I just
got done restarting the following:
SMTP
Exchange Info Store
Exchange Management
Exchange Routing Engine
Exchange System Attendant

Then I've rerun CEICW.

Last, I reset the Authentication for the SMTP Connector in ESM to that of
dyndns.org's requirements (always gets set to No Authentication when I run
CEICW).

Hope it works.

Mike
Well your email server now responds in port 25 :)
Don't know how or why, but the emails started flowing in about 15 minutes
ago. Very frustrating as I can't find anything in Event Viewer, so I have
no idea what happened -- so this may very well happen again. This is the
3rd time in 6 days I've had this problem.
Suspect your ISP/connection first, not your SBS.
Well, I contacted the ISP and they tell me that port 25 is NOT blocked, nor
can they find anything wrong at their end. I checked with dyndns.org's tech
support and they didn't see anything wrong either. The only thing I can
find is in my Alerts on ISA - I had about 20 instances within a 2-hr period
of "Service Not Responding", and the category was "Firewall Service".
However, the time period was well into the outage - did not precede it by a
large margain. There might be something in the Exchange daily log
(c:\Program Files\Exchsrver\<servername>.log\YYYYMMDD.log -- but it opens in
Notepad and I can't make heads or tails out of what it's trying to tell me.
Is there a better way to view it, and a guide on how to interpret what's in
it? (The header of it says # Message Tracking Log File # )

Mike
Any testing done would have to be done while the problem is present, not
when things are working ;-).

If you use MSDE for ISA loggging, ISA *will* lockdown if for any reason it
can't write to the logfiles. But you should get related event log entries.
OK.

Did some nosingt around in ESM and saw from <server name> > right-click
Properties > Diagnostic Logging that I can set up detailed logging. Any
suggestions on what I should enable as an effort to catch the problem as it
happens?

Mike
That probably won't help unless the issue is actually on your box, and in
Exchange - and if in fact ISA is closing the door then exchange has nothing
to log.

If incoming email stops, then first check for internet connectivity. If you
have no internet connectivity that's the problem, if you have internet
connectivity but no email coming in - then from an external location use
telnet or other tools such as http://www.dnsreport.com to check for
connectivity to your mail server, and go from there.
I've got good connectivity; outbound email is not affected and we can access
websites with the usual speed. Reports on dnsreport.com when we're down are
flagged red on the MX record "mail.whoopingcrane.org. - 70.41.130.208
[Could not connect: Could not receive data: Winsock error #10054.]" I've
rerun CEICW many times - no effect.

The part that's so puzzling is that outbound email is unaffected, as is
intra-LAN email.

Mike
Perhaps someone can translate this.

http://groups.google.ca/group/be.providers/browse_thread/thread/8559f9c3ea532bd9/44f681888f7857ec?lnk=st&q=Could+not+connect%3A+Could+not+receive+data%3A+Winsock+error+%2310054&rnum=1&hl=en#44f681888f7857ec
Thanks. Another poster made the same suggestion, and after thinking about
it over the holiday, it now makes sense.
For an unknown reason, my email stopped coming in about 45 minutes ago.
Nothing in Event Viewer, restarted all necessary Exchange services and the
SMTP service. Got into the router config. and all looks fine (port 25 IS
forwarded to the NIC).
I've got a satellite internet connection - 1.5 MB download and about 512 KB
upload. I can access the internet fine, and can send email fine, and
receive internal email.

Can't figure it out. Anthing I can check?

Mike
Yeah, odd. Just got in to work and all seems fine. Probably just "one of
those things" - very frustrating not to know WHY. Nothing remarkable in the
Event Viewer, and the Exchange log is virtually undecipherable (to me) when
I open in in Notepad.

Oh well, thanks for working with me.

Mike