[2240] in athena10
Re: [Fwd: [hostmaster] Traffic to physics.unc.edu blocked from
daemon@ATHENA.MIT.EDU (Nelson Elhage)
Mon Apr 13 11:05:02 2009
Date: Mon, 13 Apr 2009 11:04:17 -0400
From: Nelson Elhage <nelhage@MIT.EDU>
To: Stephen Joyce <stephen@physics.unc.edu>
Cc: linerva@mit.edu
Message-ID: <20090413150417.GI6229@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.64.0904131033040.21769@hellbender.physics.unc.edu>
I've started the ping.
- Nelson
On Mon, Apr 13, 2009 at 10:34:53AM -0400, Stephen Joyce wrote:
> Hi Nelson,
>
> UNC campus networking has set up a port mirror for us to capture packets
> from 18.181.0.51 to 152.2.5.15.
>
> Please start a "ping -i5 152.2.5.15" on 18.181.0.51 at 11:00AM today and
> either call or email to confirm. Please leave the ping running until you
> hear back from me (should be no later than ~ noon).
>
> Cheers, Stephen
> --
> Stephen Joyce
> PANIC - Physics and Astronomy Network Infrastructure and Computing
> University of North Carolina at Chapel Hill
> voice: 919.962.7214
> fax: 919.962.0480
>
> A cubicle is just a padded cell without a door.
>
> On Sat, 11 Apr 2009, Nelson Elhage wrote:
>
>> Does 11am on Monday work for you? Shall I call you around then to
>> coordinate?
>>
>> - Nelson
>>
>> On Fri, Apr 10, 2009 at 11:14:43PM -0400, Stephen Joyce wrote:
>>> Nelson,
>>>
>>> At what time on Monday can someone there coordinate with me to run
>>> "ping -i5 152.2.5.15" from vinegar-pot so we may see what's happening to
>>> the packets once they reach the UNC campus?
>>>
>>> Cheers, Stephen
>>> --
>>> Stephen Joyce
>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>> University of North Carolina at Chapel Hill
>>> voice: 919.962.7214
>>> fax: 919.962.0480
>>>
>>> A cubicle is just a padded cell without a door.
>>>
>>> On Fri, 10 Apr 2009, Nelson Elhage wrote:
>>>
>>>> On Thu, Apr 09, 2009 at 12:59:18PM -0400, Stephen Joyce wrote:
>>>>> Nelson,
>>>>>
>>>>> A couple of questions:
>>>>>
>>>>> Who at MIT is trying to access the UNC resources? Is there a UNC user
>>>>> currently located there or using vinegar-pot?
>>>>
>>>> We received a report from a user trying to downloade software hosted
>>>> on www.physics.unc.edu. As far as I know we do not have any UNC users
>>>> here.
>>>>
>>>>>
>>>>> A traceroute from any of our tested hosts to vinegar-pot also fails. UNC
>>>>> ITS does not believe the UNC network is dropping your packets; I do not
>>>>> believe Physics hosts are dropping your packets. Are you sure vinegar-pot
>>>>> isn't dropping UNC Physics' traffic? What do its firewall rules (or
>>>>> whatever other network filter you have in place) say regarding 152.2 or
>>>>> *.physics.unc.edu?
>>>>
>>>> Huh, odd. We currently have no firewall rules on Linerva, so we are
>>>> pretty confident we are not dropping the traffic.
>>>>
>>>> Thanks,
>>>>
>>>> - Nelson
>>>>
>>>>>
>>>>> Cheers, Stephen
>>>>> --
>>>>> Stephen Joyce
>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>> University of North Carolina at Chapel Hill
>>>>> voice: 919.962.7214
>>>>> fax: 919.962.0480
>>>>>
>>>>> A cubicle is just a padded cell without a door.
>>>>>
>>>>> On Tue, 7 Apr 2009, Nelson Elhage wrote:
>>>>>
>>>>>> Thanks for the reply, Stephen.
>>>>>>
>>>>>> `traceroute login.physics.unc.edu' fails from Linerva because we can't
>>>>>> reach ns1.physics.unc.edu. to resolve it, but tracerouting 152.2.5.5
>>>>>> drops off after el-loco-v1627.net.unc.edu:
>>>>>>
>>>>>> 1 NW12-RTR-2-SIPB.MIT.EDU (18.181.0.1) 0.349 ms 0.352 ms 0.398 ms
>>>>>> 2 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) 0.354 ms 0.417 ms 0.480 ms
>>>>>> 3 NY32-RTR-1-BACKBONE.MIT.EDU (18.168.0.34) 5.912 ms 5.976 ms 6.039 ms
>>>>>> 4 216.24.184.101 (216.24.184.101) 7.269 ms 7.279 ms 7.265 ms
>>>>>> 5 wash-newy-98.layer3.nlr.net (216.24.186.23) 11.822 ms 11.821 ms 11.806 ms
>>>>>> 6 dep7600-gw2-to-nlr-dc.ncren.net (128.109.70.101) 17.257 ms 17.197 ms 17.183 ms
>>>>>> 7 unc-manning-10G-to-dep7600-gw2.ncren.net (128.109.70.162) 18.321 ms 18.430 ms 18.510 ms
>>>>>> 8 el-loco-v1627.net.unc.edu (152.19.255.220) 18.042 ms 17.667 ms 17.668 ms
>>>>>> 9 * * *
>>>>>>
>>>>>> (mtr, using ICMP tracing, gets the same result).
>>>>>>
>>>>>> I see the same behavior for at least 152.2.5.4, 152.2.5.5, 152.2.5.15
>>>>>> (ns1.physics.unc.edu), 152.2.5.16 (ns6.physics.unc.edu), and 152.2.4.9
>>>>>> (www.panic.unc.edu).
>>>>>>
>>>>>> I've attached the output of 'ssh -vvv 152.2.5.5', but it's
>>>>>> uninteresting.
>>>>>>
>>>>>> - Nelson
>>>>>>
>>>>>> On Tue, Apr 07, 2009 at 12:05:31PM -0400, Stephen Joyce wrote:
>>>>>>> Hi Dee,
>>>>>>> Thanks for the heads-up.
>>>>>>>
>>>>>>> linerva admin:
>>>>>>> We use software which automatically blocks abusive hosts for a number of
>>>>>>> days. The 3rd such block is permanent. However each physics host does
>>>>>>> this independently and there is no block for anything in the 18.181 range
>>>>>>> on several hosts I checked.
>>>>>>>
>>>>>>> If a single host cannot ping anything in our subnet, I suspect a problem
>>>>>>> with that host's network configuration.
>>>>>>>
>>>>>>> The output of "traceroute login.physics.unc.edu", and "ssh -vvv
>>>>>>> login.physics.unc.edu" from 18.181.0.51 would be beneficial to see where
>>>>>>> the problem lies.
>>>>>>>
>>>>>>> PS. problem@physics only accepts email from unc.edu addresses by design;
>>>>>>> all our users have multiple unc.edu addresses.
>>>>>>>
>>>>>>> Cheers, Stephen
>>>>>>> --
>>>>>>> Stephen Joyce
>>>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>>>> University of North Carolina at Chapel Hill
>>>>>>> voice: 919.962.7214
>>>>>>> fax: 919.962.0480
>>>>>>>
>>>>>>> A cubicle is just a padded cell without a door.
>>>>>>>
>>>>>>> On Tue, 7 Apr 2009, Dee Jarrell wrote:
>>>>>>>
>>>>>>>>
>>>>>>>> FYI
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>>
>>>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>>
>>>>
>>>>
>>>> --
>>>>
>>>>
>>
>>
>> --
>>
>>
