tcpdump -s 0 -A -vvv -pni em1 host mail.stadium-live.ru
tcpdump: listening on em1, link-type EN10MB (Ethernet), capture size 65535 bytes
10:11:40.982213 IP (tos 0x0, ttl 64, id 11558, offset 0, flags [DF], proto TCP (6), length 60)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [S], cksum 0x96ec (incorrect -> 0xde94), seq 3150191830, win 65535, options [mss 1460,nop,wscale 3,sackOK,TS val 1283373055 ecr 0], length 0
E..<-&@.@.v.No],N..
...............................
L~......
10:11:41.108763 IP (tos 0x0, ttl 121, id 25139, offset 0, flags [DF], proto TCP (6), length 60)
    78.24.157.10.25 > 78.111.93.44.62847: Flags [S.], cksum 0xdefd (correct), seq 2419068714, ack 3150191831, win 8192, options [mss 1380,nop,wscale 8,sackOK,TS val 68500577 ecr 1283373055], length 0
E..<b3@.y...N..
No],.....0.*...... ........d.......
..<aL~..
10:11:41.108803 IP (tos 0x0, ttl 64, id 11559, offset 0, flags [DF], proto TCP (6), length 52)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x96e4 (incorrect -> 0x0cec), seq 1, ack 1, win 8208, options [nop,nop,TS val 1283373182 ecr 68500577], length 0
E..4-'@.@.v.No],N..
.........0.+.. ........
L~.~..<a
10:11:41.312397 IP (tos 0x0, ttl 121, id 25142, offset 0, flags [DF], proto TCP (6), length 145)
    78.24.157.10.25 > 78.111.93.44.62847: Flags [P.], cksum 0x7f14 (correct), seq 1:94, ack 1, win 513, options [nop,nop,TS val 68500590 ecr 1283373182], length 93
E...b6@.y..sN..
No],.....0.+...............
..<nL~.~220 ***************************************************************************************

10:11:41.312536 IP (tos 0x0, ttl 64, id 11560, offset 0, flags [DF], proto TCP (6), length 70)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [P.], cksum 0x96f6 (incorrect -> 0x3cef), seq 1:19, ack 94, win 8208, options [nop,nop,TS val 1283373385 ecr 68500590], length 18
E..F-(@.@.v.No],N..
.........0.... ........
L~.I..<nEHLO mail.nca.ru

10:11:41.515526 IP (tos 0x0, ttl 121, id 25146, offset 0, flags [DF], proto TCP (6), length 311)
    78.24.157.10.25 > 78.111.93.44.62847: Flags [P.], cksum 0x12b9 (correct), seq 94:353, ack 19, win 512, options [nop,nop,TS val 68500611 ecr 1283373385], length 259
E..7b:@.y...N..
No],.....0.................
..<.L~.I250-srv-ex1.stadium.ru Hello [78.111.93.44]
250-SIZE
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-XXXXXXXA
250-XXXXXXXXXXXXXB
250-AUTH NTLM
250-XXXXXXXXXXXXXXXXXC
250-8BITMIME
250-BINARYMIME
250-XXXXXXXD
250-XXXXXXE
250-XXXXF
250 XXXXXXG

10:11:41.515623 IP (tos 0x0, ttl 64, id 11569, offset 0, flags [DF], proto TCP (6), length 179)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [P.], cksum 0x9763 (incorrect -> 0x8bdb), seq 19:146, ack 353, win 8208, options [nop,nop,TS val 1283373589 ecr 68500611], length 127
E...-1@.@.vVNo],N..
.........0.... ..c.....
L~....<.MAIL FROM:<it@nca.ru> SIZE=1957 BODY=7BIT
RCPT TO:<a.balashov@stadium-live.ru> ORCPT=rfc822;a.balashov@stadium-live.ru
DATA

10:11:41.715954 IP (tos 0x0, ttl 121, id 25154, offset 0, flags [DF], proto TCP (6), length 143)
    78.24.157.10.25 > 78.111.93.44.62847: Flags [P.], cksum 0xd1ed (correct), seq 353:444, ack 146, win 512, options [nop,nop,TS val 68500631 ecr 1283373589], length 91
E...bB@.y..iN..
No],.....0.....h...........
..<.L~..250 2.1.0 Sender OK
250 2.1.5 Recipient OK
354 Start mail input; end with <CRLF>.<CRLF>

10:11:41.716046 IP bad-len 0
E...-2@.@...No],N..
.......h.0.... ........
L~....<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Message-ID: <55C45A29.1050805@nca.ru>
Date: Fri, 07 Aug 2015 10:11:37 +0300
From: "Igor N. Dybtsev" <it@nca.ru>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.8.0
MIME-Version: 1.0
To: =?UTF-8?B?0JHQsNC70LDRiNC+0LIg0JDQu9C10LrRgdC10Lk=?=
 <a.balashov@stadium-live.ru>
Subject: test direct
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable

     =D0=9F=D1=80=D0=BE=D0=B1=D1=83=D1=8E =D0=BD=D0=B0=D0=BF=D1=80=D1=8F=D0=
=BC=D1=83=D1=8E.

--=20
Best Regards, Igor, sysadmin

.
QUIT

10:11:42.333172 IP (tos 0x0, ttl 64, id 11571, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0x1de5), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283374407 ecr 68500631], length 1368
E...-3@.@.q{No],N..
.......h.0.... ..<.....
L~.G..<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:11:43.362011 IP (tos 0x0, ttl 64, id 11580, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0x19e1), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283375435 ecr 68500631], length 1368
E...-<@.@.qrNo],N..
.......h.0.... ..<.....
L~.K..<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:11:45.216184 IP (tos 0x0, ttl 64, id 11584, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0x12a2), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283377290 ecr 68500631], length 1368
E...-@@.@.qnNo],N..
.......h.0.... ..<.....
L~....<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:11:48.724436 IP (tos 0x0, ttl 64, id 11601, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0x04ee), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283380798 ecr 68500631], length 1368
E...-Q@.@.q]No],N..
.......h.0.... ..<.....
L~.>..<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:11:55.527858 IP (tos 0x0, ttl 64, id 11902, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0xea5a), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283387601 ecr 68500631], length 1368
E....~@.@.p0No],N..
.......h.0.... ..<.....
L~....<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:12:05.417652 IP (tos 0x0, ttl 64, id 11988, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0xc3b8), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283397491 ecr 68500631], length 1368
E.....@.@.o.No],N..
.......h.0.... ..<.....
L..s..<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:
10:12:24.993117 IP (tos 0x0, ttl 64, id 11999, offset 0, flags [DF], proto TCP (6), length 1420)
    78.111.93.44.62847 > 78.24.157.10.25: Flags [.], cksum 0x9c3c (incorrect -> 0x7741), seq 146:1514, ack 444, win 8208, options [nop,nop,TS val 1283417066 ecr 68500631], length 1368
E.....@.@.o.No],N..
.......h.0.... ..<.....
L.c...<.Received: from ncamail.office.local (localhost [127.0.0.1])
	by mail.nca.ru (Postfix) with ESMTP id B6B493F469
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Authentication-Results: ncamail.office.local (amavisd-new);
	dkim=pass (1024-bit key) reason="pass (just generated, assumed good)"
	header.d=nca.ru
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nca.ru; h=
	content-transfer-encoding:content-type:content-type:subject
	:subject:mime-version:user-agent:from:from:date:date:message-id
	:received:received; s=nca; t=1438931499; bh=YDZ9Po1L80EErz3AvC9B
	OUWyjohdAHUDrZk1zcY+8cM=; b=C1gipL16ubnrPvBSp2+6QEH+FrLNyOQkCsLv
	HIVa4x+NuVWeAKKwKX8Y3FdfwPaXWJyOxOMufnVNlE8326BosPmEEp6Nm+nx6gKb
	Qi/NZ9JuuLgc4bhVYgzrfoFSoqap61R8xPwyiaQWIzO4ZxgGjV2av69VSMEQhuaK
	9yqj4eI=
X-Virus-Scanned: amavisd-new at office.local
Received: from mail.nca.ru ([127.0.0.1])
	by ncamail.office.local (ncamail.office.local [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id Xq877_iLyJie for <a.balashov@stadium-live.ru>;
	Fri,  7 Aug 2015 10:11:39 +0300 (MSK)
Received: from [192.168.111.22] (igornik.spb.ru [109.167.145.218])
	(using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits))
	(No client certificate requested)
	by mail.nca.ru (Postfix) with ESMTPSA id 8C7DB3F466
	for <a.balashov@stadium-live.ru>; Fri,  7 Aug 2015 10:11: