[2241] in athena10
Re: [Fwd: [hostmaster] Traffic to physics.unc.edu blocked from
daemon@ATHENA.MIT.EDU (Stephen Joyce)
Mon Apr 13 11:20:38 2009
Date: Mon, 13 Apr 2009 11:20:26 -0400 (EDT)
From: Stephen Joyce <stephen@physics.unc.edu>
To: Nelson Elhage <nelhage@MIT.EDU>
cc: linerva@MIT.EDU
In-Reply-To: <20090413150417.GI6229@mit.edu>
Message-ID: <Pine.LNX.4.64.0904131119120.21769@hellbender.physics.unc.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Content-Disposition: inline
Hi Nelson,
Can you please stop the ping to 152.2.5.15 and start "ping 152.2.5.17"
continuously, instead? Please reply when done.
Cheers, Stephen
--
Stephen Joyce
PANIC - Physics and Astronomy Network Infrastructure and Computing
University of North Carolina at Chapel Hill
voice: 919.962.7214
fax: 919.962.0480
A cubicle is just a padded cell without a door.
On Mon, 13 Apr 2009, Nelson Elhage wrote:
> I've started the ping.
>
> - Nelson
>
> On Mon, Apr 13, 2009 at 10:34:53AM -0400, Stephen Joyce wrote:
>> Hi Nelson,
>>
>> UNC campus networking has set up a port mirror for us to capture packets
>> from 18.181.0.51 to 152.2.5.15.
>>
>> Please start a "ping -i5 152.2.5.15" on 18.181.0.51 at 11:00AM today and
>> either call or email to confirm. Please leave the ping running until you
>> hear back from me (should be no later than ~ noon).
>>
>> Cheers, Stephen
>> --
>> Stephen Joyce
>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>> University of North Carolina at Chapel Hill
>> voice: 919.962.7214
>> fax: 919.962.0480
>>
>> A cubicle is just a padded cell without a door.
>>
>> On Sat, 11 Apr 2009, Nelson Elhage wrote:
>>
>>> Does 11am on Monday work for you? Shall I call you around then to
>>> coordinate?
>>>
>>> - Nelson
>>>
>>> On Fri, Apr 10, 2009 at 11:14:43PM -0400, Stephen Joyce wrote:
>>>> Nelson,
>>>>
>>>> At what time on Monday can someone there coordinate with me to run
>>>> "ping -i5 152.2.5.15" from vinegar-pot so we may see what's happening to
>>>> the packets once they reach the UNC campus?
>>>>
>>>> Cheers, Stephen
>>>> --
>>>> Stephen Joyce
>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>> University of North Carolina at Chapel Hill
>>>> voice: 919.962.7214
>>>> fax: 919.962.0480
>>>>
>>>> A cubicle is just a padded cell without a door.
>>>>
>>>> On Fri, 10 Apr 2009, Nelson Elhage wrote:
>>>>
>>>>> On Thu, Apr 09, 2009 at 12:59:18PM -0400, Stephen Joyce wrote:
>>>>>> Nelson,
>>>>>>
>>>>>> A couple of questions:
>>>>>>
>>>>>> Who at MIT is trying to access the UNC resources? Is there a UNC user
>>>>>> currently located there or using vinegar-pot?
>>>>>
>>>>> We received a report from a user trying to downloade software hosted
>>>>> on www.physics.unc.edu. As far as I know we do not have any UNC users
>>>>> here.
>>>>>
>>>>>>
>>>>>> A traceroute from any of our tested hosts to vinegar-pot also fails. UNC
>>>>>> ITS does not believe the UNC network is dropping your packets; I do not
>>>>>> believe Physics hosts are dropping your packets. Are you sure vinegar-pot
>>>>>> isn't dropping UNC Physics' traffic? What do its firewall rules (or
>>>>>> whatever other network filter you have in place) say regarding 152.2 or
>>>>>> *.physics.unc.edu?
>>>>>
>>>>> Huh, odd. We currently have no firewall rules on Linerva, so we are
>>>>> pretty confident we are not dropping the traffic.
>>>>>
>>>>> Thanks,
>>>>>
>>>>> - Nelson
>>>>>
>>>>>>
>>>>>> Cheers, Stephen
>>>>>> --
>>>>>> Stephen Joyce
>>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>>> University of North Carolina at Chapel Hill
>>>>>> voice: 919.962.7214
>>>>>> fax: 919.962.0480
>>>>>>
>>>>>> A cubicle is just a padded cell without a door.
>>>>>>
>>>>>> On Tue, 7 Apr 2009, Nelson Elhage wrote:
>>>>>>
>>>>>>> Thanks for the reply, Stephen.
>>>>>>>
>>>>>>> `traceroute login.physics.unc.edu' fails from Linerva because we can't
>>>>>>> reach ns1.physics.unc.edu. to resolve it, but tracerouting 152.2.5.5
>>>>>>> drops off after el-loco-v1627.net.unc.edu:
>>>>>>>
>>>>>>> 1 NW12-RTR-2-SIPB.MIT.EDU (18.181.0.1) 0.349 ms 0.352 ms 0.398 ms
>>>>>>> 2 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) 0.354 ms 0.417 ms 0.480 ms
>>>>>>> 3 NY32-RTR-1-BACKBONE.MIT.EDU (18.168.0.34) 5.912 ms 5.976 ms 6.039 ms
>>>>>>> 4 216.24.184.101 (216.24.184.101) 7.269 ms 7.279 ms 7.265 ms
>>>>>>> 5 wash-newy-98.layer3.nlr.net (216.24.186.23) 11.822 ms 11.821 ms 11.806 ms
>>>>>>> 6 dep7600-gw2-to-nlr-dc.ncren.net (128.109.70.101) 17.257 ms 17.197 ms 17.183 ms
>>>>>>> 7 unc-manning-10G-to-dep7600-gw2.ncren.net (128.109.70.162) 18.321 ms 18.430 ms 18.510 ms
>>>>>>> 8 el-loco-v1627.net.unc.edu (152.19.255.220) 18.042 ms 17.667 ms 17.668 ms
>>>>>>> 9 * * *
>>>>>>>
>>>>>>> (mtr, using ICMP tracing, gets the same result).
>>>>>>>
>>>>>>> I see the same behavior for at least 152.2.5.4, 152.2.5.5, 152.2.5.15
>>>>>>> (ns1.physics.unc.edu), 152.2.5.16 (ns6.physics.unc.edu), and 152.2.4.9
>>>>>>> (www.panic.unc.edu).
>>>>>>>
>>>>>>> I've attached the output of 'ssh -vvv 152.2.5.5', but it's
>>>>>>> uninteresting.
>>>>>>>
>>>>>>> - Nelson
>>>>>>>
>>>>>>> On Tue, Apr 07, 2009 at 12:05:31PM -0400, Stephen Joyce wrote:
>>>>>>>> Hi Dee,
>>>>>>>> Thanks for the heads-up.
>>>>>>>>
>>>>>>>> linerva admin:
>>>>>>>> We use software which automatically blocks abusive hosts for a number of
>>>>>>>> days. The 3rd such block is permanent. However each physics host does
>>>>>>>> this independently and there is no block for anything in the 18.181 range
>>>>>>>> on several hosts I checked.
>>>>>>>>
>>>>>>>> If a single host cannot ping anything in our subnet, I suspect a problem
>>>>>>>> with that host's network configuration.
>>>>>>>>
>>>>>>>> The output of "traceroute login.physics.unc.edu", and "ssh -vvv
>>>>>>>> login.physics.unc.edu" from 18.181.0.51 would be beneficial to see where
>>>>>>>> the problem lies.
>>>>>>>>
>>>>>>>> PS. problem@physics only accepts email from unc.edu addresses by design;
>>>>>>>> all our users have multiple unc.edu addresses.
>>>>>>>>
>>>>>>>> Cheers, Stephen
>>>>>>>> --
>>>>>>>> Stephen Joyce
>>>>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>>>>> University of North Carolina at Chapel Hill
>>>>>>>> voice: 919.962.7214
>>>>>>>> fax: 919.962.0480
>>>>>>>>
>>>>>>>> A cubicle is just a padded cell without a door.
>>>>>>>>
>>>>>>>> On Tue, 7 Apr 2009, Dee Jarrell wrote:
>>>>>>>>
>>>>>>>>>
>>>>>>>>> FYI
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>>
>>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>>
>>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>>
>>>
>>>
>>> --
>>>
>>>
>
>
> --
>
>
