[2172] in athena10
Re: [Fwd: [hostmaster] Traffic to physics.unc.edu blocked from
daemon@ATHENA.MIT.EDU (Nelson Elhage)
Fri Apr 10 17:33:26 2009
Date: Fri, 10 Apr 2009 17:32:41 -0400
From: Nelson Elhage <nelhage@MIT.EDU>
To: Stephen Joyce <stephen@physics.unc.edu>
Cc: linerva@mit.edu
Message-ID: <20090410213241.GA6229@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.64.0904091254140.32650@hellbender.physics.unc.edu>
On Thu, Apr 09, 2009 at 12:59:18PM -0400, Stephen Joyce wrote:
> Nelson,
>
> A couple of questions:
>
> Who at MIT is trying to access the UNC resources? Is there a UNC user
> currently located there or using vinegar-pot?
We received a report from a user trying to downloade software hosted
on www.physics.unc.edu. As far as I know we do not have any UNC users
here.
>
> A traceroute from any of our tested hosts to vinegar-pot also fails. UNC
> ITS does not believe the UNC network is dropping your packets; I do not
> believe Physics hosts are dropping your packets. Are you sure vinegar-pot
> isn't dropping UNC Physics' traffic? What do its firewall rules (or
> whatever other network filter you have in place) say regarding 152.2 or
> *.physics.unc.edu?
Huh, odd. We currently have no firewall rules on Linerva, so we are
pretty confident we are not dropping the traffic.
Thanks,
- Nelson
>
> Cheers, Stephen
> --
> Stephen Joyce
> PANIC - Physics and Astronomy Network Infrastructure and Computing
> University of North Carolina at Chapel Hill
> voice: 919.962.7214
> fax: 919.962.0480
>
> A cubicle is just a padded cell without a door.
>
> On Tue, 7 Apr 2009, Nelson Elhage wrote:
>
>> Thanks for the reply, Stephen.
>>
>> `traceroute login.physics.unc.edu' fails from Linerva because we can't
>> reach ns1.physics.unc.edu. to resolve it, but tracerouting 152.2.5.5
>> drops off after el-loco-v1627.net.unc.edu:
>>
>> 1 NW12-RTR-2-SIPB.MIT.EDU (18.181.0.1) 0.349 ms 0.352 ms 0.398 ms
>> 2 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) 0.354 ms 0.417 ms 0.480 ms
>> 3 NY32-RTR-1-BACKBONE.MIT.EDU (18.168.0.34) 5.912 ms 5.976 ms 6.039 ms
>> 4 216.24.184.101 (216.24.184.101) 7.269 ms 7.279 ms 7.265 ms
>> 5 wash-newy-98.layer3.nlr.net (216.24.186.23) 11.822 ms 11.821 ms 11.806 ms
>> 6 dep7600-gw2-to-nlr-dc.ncren.net (128.109.70.101) 17.257 ms 17.197 ms 17.183 ms
>> 7 unc-manning-10G-to-dep7600-gw2.ncren.net (128.109.70.162) 18.321 ms 18.430 ms 18.510 ms
>> 8 el-loco-v1627.net.unc.edu (152.19.255.220) 18.042 ms 17.667 ms 17.668 ms
>> 9 * * *
>>
>> (mtr, using ICMP tracing, gets the same result).
>>
>> I see the same behavior for at least 152.2.5.4, 152.2.5.5, 152.2.5.15
>> (ns1.physics.unc.edu), 152.2.5.16 (ns6.physics.unc.edu), and 152.2.4.9
>> (www.panic.unc.edu).
>>
>> I've attached the output of 'ssh -vvv 152.2.5.5', but it's
>> uninteresting.
>>
>> - Nelson
>>
>> On Tue, Apr 07, 2009 at 12:05:31PM -0400, Stephen Joyce wrote:
>>> Hi Dee,
>>> Thanks for the heads-up.
>>>
>>> linerva admin:
>>> We use software which automatically blocks abusive hosts for a number of
>>> days. The 3rd such block is permanent. However each physics host does
>>> this independently and there is no block for anything in the 18.181 range
>>> on several hosts I checked.
>>>
>>> If a single host cannot ping anything in our subnet, I suspect a problem
>>> with that host's network configuration.
>>>
>>> The output of "traceroute login.physics.unc.edu", and "ssh -vvv
>>> login.physics.unc.edu" from 18.181.0.51 would be beneficial to see where
>>> the problem lies.
>>>
>>> PS. problem@physics only accepts email from unc.edu addresses by design;
>>> all our users have multiple unc.edu addresses.
>>>
>>> Cheers, Stephen
>>> --
>>> Stephen Joyce
>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>> University of North Carolina at Chapel Hill
>>> voice: 919.962.7214
>>> fax: 919.962.0480
>>>
>>> A cubicle is just a padded cell without a door.
>>>
>>> On Tue, 7 Apr 2009, Dee Jarrell wrote:
>>>
>>>>
>>>> FYI
>>>>
>>>>
>>>> --
>>>>
>>>>
>>
>>
>> --
>>
>>
