How It Works

 # nmap -sV -p 25 --packet_trace mail.insecure.org
Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2003-12-02 12:37 PST
SENT (0.0260s) ICMP 63.202.174.201 > 205.217.153.50 Echo request (type=8/code=0) ttl=56 iplen=28
SENT (0.0280s) TCP 63.202.174.201:48502 > 205.217.153.50:80 A ttl=38 
RCVD (0.0400s) ICMP 205.217.153.50 > 63.202.174.201 Echo reply (type=0/code=0) ttl=56 iplen=28

SENT (0.3320s) TCP 63.202.174.201:48481 > 205.217.153.50:25 S ttl=37
RCVD (0.3430s) TCP 205.217.153.50:25 > 63.202.174.201:48481 SA ttl=56 iplen=44

NSOCK (0.3520s) TCP connection requested to 205.217.153.50:25 (IOD #1) EID 8
NSOCK (0.3660s) Callback: CONNECT SUCCESS for EID 8 [205.217.153.50:25]
NSOCK (0.3660s) Read request from IOD #1 [205.217.153.50:25] (timeout: 5000ms) EID 18
NSOCK (0.3990s) Callback: READ SUCCESS for EID 18 [205.217.153.50:25] (27 bytes): 
                220 core.lnxnet.net ESMTP..
NSOCK (0.3990s) Read request from IOD #1 [205.217.153.50:25] (timeout: 4965ms) EID 26
NSOCK (5.3690s) Callback: READ TIMEOUT for EID 26 [205.217.153.50:25]
NSOCK (5.3690s) Write request for 6 bytes to IOD #1 EID 35 [205.217.153.50:25]: HELP..
NSOCK (5.3690s) Read request from IOD #1 [205.217.153.50:25] (timeout: 5000ms) EID 42
NSOCK (5.3750s) Callback: WRITE SUCCESS for EID 35 [205.217.153.50:25]
NSOCK (5.3890s) Callback: READ SUCCESS for EID 42 [205.217.153.50:25] (55 bytes): 
                214 qmail home page: http://pobox.com/~djb/qmail.html..

Interesting ports on core.lnxnet.net (205.217.153.50):
PORT   STATE SERVICE VERSION
25/tcp open  smtp    qmail smtpd

Nmap run completed -- 1 IP address (1 host up) scanned in 5.425 seconds