Source Port 25?

Recently, I was asked if a new installation of Exchange 2007 could cause a spike in network traffic. I was sent some logs to review (I've hidden the full source IPs and changed the destination IP in a minor way):

The first thing I noticed was that the source port, not the destination port, was 25. SMTP uses port 25 to receive data, but does not use a static port for sending. The second thing I checked was to see what the name of the destination host was -- and it was not an Exchange server (or any other mail server).

I relayed this information back, and the workstation all of the traffic was destined to (192.169.1.1 for our purposes) was found and pulled from the network.

Lesson: Read the whole log.

The Good News

The good news with Exchange 2007 is that the uninstall process is flawless. Being the dork that I am, I went through and removed all directories (well, moved the directories first, then whacked 'em later) and registry entries and such post-uninstall, but that's really not necessary. You do have to remove the edb and log files manually before reinstalling, but other than that, it's smooth like buttah.

Don't be a dork - CCR clusters

When you're installing a CCR cluster, you need to first cluster Windows, then do a custom install of Exchange, choosing either to install the Active Clustered Mailbox role (first) or the Passive Clustered Mailbox rold (second). Don't install Exchange assuming that you can go back and create a CCR cluster later.

LCR clusters, OTOH, can be created after Exchange has been installed.

Lesson of the day: Always review your docs before installing. Unless you like watching installs.