I would check those IIS SMTP logs way before I run a packet capture. Also, you could check the same service on the voicemail switch. Some more obvious questions - is the SMTP service up and running on the server? Servers that have been up for a long time like 6 months or more, always tend to have SMTP failures showing in Director. I have never seen anyone been able to get secure SMTP to work between the appliances and servers. Are you trying to use secure SMTP in your IIS settings on the server? I've seen customers do this unintentionally trying to get encrypted SMTP traffic between ShoreTel server and mail server - but this breaks internal SMTP communication between ShoreTel gear. What does the SMTP log say? Can you telnet to port 25 on the voicemail switch and get a response? You should be able to interact with SMTP server and manually send mail.

Generate some SMTP traffic by either using SSH to remote into voicemail switch and drop to cfg.exe at linux prompt, or RDP'ing to ShoreTel server and using same cfg.exe program to send an 'SMTP ping' (the command is actually sndping, but you need to get the name of the server/switch by using 'lserv' first). After retransmission >, the sender continues normal data transmission. As in Jacobsons fast retransmit algorithm, when the sender receives 3rd duplicate ACK, it assumes that the packet is lost and retransmit that packet without waiting for a retransmission timer to expire. Crank up your IIS SMTP logging on your ShoreTel server. Fast retransmit is a modification to the congestion avoidance algorithm.

Tcp retransmission wireshark shoretel