Cisco Cisco Email Security Appliance X1050 정보 가이드
What does "ICID lost" or "ICID close" mean?
Document ID: 118579
Contributed by Cisco TAC Engineers.
Oct 14, 2014
Contents
Question
Answer
Related Information
Answer
Related Information
Question
What does "ICID lost" or "ICID close" mean?
Answer
In relation to mail processing on the Cisco Email Security Appliance (ESA), some clients disconnect after
they get shown the EHLO size limit. Those clients do not send a QUIT, but end the connection perfectly
normal on a TCP−base level. In this instance, the ESA will log ICID lost.
they get shown the EHLO size limit. Those clients do not send a QUIT, but end the connection perfectly
normal on a TCP−base level. In this instance, the ESA will log ICID lost.
This typically happens when either the ESA loses the connection, or the sending client prematurely ends the
connection without sending us the entire message. This would mean that the remote host connected but did
not send any data.
connection without sending us the entire message. This would mean that the remote host connected but did
not send any data.
If you know the sending domain, host name, or IP address, you can take a closer look at this occurrence by
enabling Injection Debug logs. This will give you more detailed information during the SMTP conversation.
Debug logging can be turned on from the CLI by using logconfig > new, or from the GUI by enabling a new
Log Subscription.
enabling Injection Debug logs. This will give you more detailed information during the SMTP conversation.
Debug logging can be turned on from the CLI by using logconfig > new, or from the GUI by enabling a new
Log Subscription.
Related Information
Cisco Email Security Appliance − End−User Guides
•
Technical Support & Documentation − Cisco Systems
•
Updated: Oct 14, 2014
Document ID: 118579