[2174] in athena10
Re: [Fwd: [hostmaster] Traffic to physics.unc.edu blocked from
daemon@ATHENA.MIT.EDU (Stephen Joyce)
Fri Apr 10 23:14:55 2009
Date: Fri, 10 Apr 2009 23:14:43 -0400 (EDT)
From: Stephen Joyce <stephen@physics.unc.edu>
To: Nelson Elhage <nelhage@MIT.EDU>
cc: linerva@MIT.EDU
In-Reply-To: <20090410213241.GA6229@mit.edu>
Message-ID: <Pine.LNX.4.64.0904102247540.21769@hellbender.physics.unc.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Content-Disposition: inline
Nelson,
At what time on Monday can someone there coordinate with me to run
"ping -i5 152.2.5.15" from vinegar-pot so we may see what's happening to
the packets once they reach the UNC campus?
Cheers, Stephen
--
Stephen Joyce
PANIC - Physics and Astronomy Network Infrastructure and Computing
University of North Carolina at Chapel Hill
voice: 919.962.7214
fax: 919.962.0480
A cubicle is just a padded cell without a door.
On Fri, 10 Apr 2009, Nelson Elhage wrote:
> On Thu, Apr 09, 2009 at 12:59:18PM -0400, Stephen Joyce wrote:
>> Nelson,
>>
>> A couple of questions:
>>
>> Who at MIT is trying to access the UNC resources? Is there a UNC user
>> currently located there or using vinegar-pot?
>
> We received a report from a user trying to downloade software hosted
> on www.physics.unc.edu. As far as I know we do not have any UNC users
> here.
>
>>
>> A traceroute from any of our tested hosts to vinegar-pot also fails. UNC
>> ITS does not believe the UNC network is dropping your packets; I do not
>> believe Physics hosts are dropping your packets. Are you sure vinegar-pot
>> isn't dropping UNC Physics' traffic? What do its firewall rules (or
>> whatever other network filter you have in place) say regarding 152.2 or
>> *.physics.unc.edu?
>
> Huh, odd. We currently have no firewall rules on Linerva, so we are
> pretty confident we are not dropping the traffic.
>
> Thanks,
>
> - Nelson
>
>>
>> Cheers, Stephen
>> --
>> Stephen Joyce
>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>> University of North Carolina at Chapel Hill
>> voice: 919.962.7214
>> fax: 919.962.0480
>>
>> A cubicle is just a padded cell without a door.
>>
>> On Tue, 7 Apr 2009, Nelson Elhage wrote:
>>
>>> Thanks for the reply, Stephen.
>>>
>>> `traceroute login.physics.unc.edu' fails from Linerva because we can't
>>> reach ns1.physics.unc.edu. to resolve it, but tracerouting 152.2.5.5
>>> drops off after el-loco-v1627.net.unc.edu:
>>>
>>> 1 NW12-RTR-2-SIPB.MIT.EDU (18.181.0.1) 0.349 ms 0.352 ms 0.398 ms
>>> 2 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) 0.354 ms 0.417 ms 0.480 ms
>>> 3 NY32-RTR-1-BACKBONE.MIT.EDU (18.168.0.34) 5.912 ms 5.976 ms 6.039 ms
>>> 4 216.24.184.101 (216.24.184.101) 7.269 ms 7.279 ms 7.265 ms
>>> 5 wash-newy-98.layer3.nlr.net (216.24.186.23) 11.822 ms 11.821 ms 11.806 ms
>>> 6 dep7600-gw2-to-nlr-dc.ncren.net (128.109.70.101) 17.257 ms 17.197 ms 17.183 ms
>>> 7 unc-manning-10G-to-dep7600-gw2.ncren.net (128.109.70.162) 18.321 ms 18.430 ms 18.510 ms
>>> 8 el-loco-v1627.net.unc.edu (152.19.255.220) 18.042 ms 17.667 ms 17.668 ms
>>> 9 * * *
>>>
>>> (mtr, using ICMP tracing, gets the same result).
>>>
>>> I see the same behavior for at least 152.2.5.4, 152.2.5.5, 152.2.5.15
>>> (ns1.physics.unc.edu), 152.2.5.16 (ns6.physics.unc.edu), and 152.2.4.9
>>> (www.panic.unc.edu).
>>>
>>> I've attached the output of 'ssh -vvv 152.2.5.5', but it's
>>> uninteresting.
>>>
>>> - Nelson
>>>
>>> On Tue, Apr 07, 2009 at 12:05:31PM -0400, Stephen Joyce wrote:
>>>> Hi Dee,
>>>> Thanks for the heads-up.
>>>>
>>>> linerva admin:
>>>> We use software which automatically blocks abusive hosts for a number of
>>>> days. The 3rd such block is permanent. However each physics host does
>>>> this independently and there is no block for anything in the 18.181 range
>>>> on several hosts I checked.
>>>>
>>>> If a single host cannot ping anything in our subnet, I suspect a problem
>>>> with that host's network configuration.
>>>>
>>>> The output of "traceroute login.physics.unc.edu", and "ssh -vvv
>>>> login.physics.unc.edu" from 18.181.0.51 would be beneficial to see where
>>>> the problem lies.
>>>>
>>>> PS. problem@physics only accepts email from unc.edu addresses by design;
>>>> all our users have multiple unc.edu addresses.
>>>>
>>>> Cheers, Stephen
>>>> --
>>>> Stephen Joyce
>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>> University of North Carolina at Chapel Hill
>>>> voice: 919.962.7214
>>>> fax: 919.962.0480
>>>>
>>>> A cubicle is just a padded cell without a door.
>>>>
>>>> On Tue, 7 Apr 2009, Dee Jarrell wrote:
>>>>
>>>>>
>>>>> FYI
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>>
>>>
>>>
>>> --
>>>
>>>
>
>
> --
>
>
