[2243] in athena10
Re: [Fwd: [hostmaster] Traffic to physics.unc.edu blocked from
daemon@ATHENA.MIT.EDU (Nelson Elhage)
Mon Apr 13 12:12:01 2009
Date: Mon, 13 Apr 2009 12:11:18 -0400
From: Nelson Elhage <nelhage@MIT.EDU>
To: Stephen Joyce <stephen@physics.unc.edu>
Cc: linerva@mit.edu
Message-ID: <20090413161118.GJ6229@mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.64.0904131209030.21769@hellbender.physics.unc.edu>
Thanks for looking into this, Stephen. I've stopped the pings.
- Nelson
On Mon, Apr 13, 2009 at 12:09:49PM -0400, Stephen Joyce wrote:
> Hi Nelson,
>
> You may stop both pings.
>
> Networking believes this is a problem with its Tipping Point hardware and
> is double-checking its config.
>
> I will followup when they have more info and/or have solved the problem.
>
> Cheers, Stephen
> --
> Stephen Joyce
> PANIC - Physics and Astronomy Network Infrastructure and Computing
> University of North Carolina at Chapel Hill
> voice: 919.962.7214
> fax: 919.962.0480
>
> A cubicle is just a padded cell without a door.
>
> On Mon, 13 Apr 2009, Nelson Elhage wrote:
>
>> I've started the ping.
>>
>> - Nelson
>>
>> On Mon, Apr 13, 2009 at 10:34:53AM -0400, Stephen Joyce wrote:
>>> Hi Nelson,
>>>
>>> UNC campus networking has set up a port mirror for us to capture packets
>>> from 18.181.0.51 to 152.2.5.15.
>>>
>>> Please start a "ping -i5 152.2.5.15" on 18.181.0.51 at 11:00AM today and
>>> either call or email to confirm. Please leave the ping running until you
>>> hear back from me (should be no later than ~ noon).
>>>
>>> Cheers, Stephen
>>> --
>>> Stephen Joyce
>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>> University of North Carolina at Chapel Hill
>>> voice: 919.962.7214
>>> fax: 919.962.0480
>>>
>>> A cubicle is just a padded cell without a door.
>>>
>>> On Sat, 11 Apr 2009, Nelson Elhage wrote:
>>>
>>>> Does 11am on Monday work for you? Shall I call you around then to
>>>> coordinate?
>>>>
>>>> - Nelson
>>>>
>>>> On Fri, Apr 10, 2009 at 11:14:43PM -0400, Stephen Joyce wrote:
>>>>> Nelson,
>>>>>
>>>>> At what time on Monday can someone there coordinate with me to run
>>>>> "ping -i5 152.2.5.15" from vinegar-pot so we may see what's happening to
>>>>> the packets once they reach the UNC campus?
>>>>>
>>>>> Cheers, Stephen
>>>>> --
>>>>> Stephen Joyce
>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>> University of North Carolina at Chapel Hill
>>>>> voice: 919.962.7214
>>>>> fax: 919.962.0480
>>>>>
>>>>> A cubicle is just a padded cell without a door.
>>>>>
>>>>> On Fri, 10 Apr 2009, Nelson Elhage wrote:
>>>>>
>>>>>> On Thu, Apr 09, 2009 at 12:59:18PM -0400, Stephen Joyce wrote:
>>>>>>> Nelson,
>>>>>>>
>>>>>>> A couple of questions:
>>>>>>>
>>>>>>> Who at MIT is trying to access the UNC resources? Is there a UNC user
>>>>>>> currently located there or using vinegar-pot?
>>>>>>
>>>>>> We received a report from a user trying to downloade software hosted
>>>>>> on www.physics.unc.edu. As far as I know we do not have any UNC users
>>>>>> here.
>>>>>>
>>>>>>>
>>>>>>> A traceroute from any of our tested hosts to vinegar-pot also fails. UNC
>>>>>>> ITS does not believe the UNC network is dropping your packets; I do not
>>>>>>> believe Physics hosts are dropping your packets. Are you sure vinegar-pot
>>>>>>> isn't dropping UNC Physics' traffic? What do its firewall rules (or
>>>>>>> whatever other network filter you have in place) say regarding 152.2 or
>>>>>>> *.physics.unc.edu?
>>>>>>
>>>>>> Huh, odd. We currently have no firewall rules on Linerva, so we are
>>>>>> pretty confident we are not dropping the traffic.
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> - Nelson
>>>>>>
>>>>>>>
>>>>>>> Cheers, Stephen
>>>>>>> --
>>>>>>> Stephen Joyce
>>>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>>>> University of North Carolina at Chapel Hill
>>>>>>> voice: 919.962.7214
>>>>>>> fax: 919.962.0480
>>>>>>>
>>>>>>> A cubicle is just a padded cell without a door.
>>>>>>>
>>>>>>> On Tue, 7 Apr 2009, Nelson Elhage wrote:
>>>>>>>
>>>>>>>> Thanks for the reply, Stephen.
>>>>>>>>
>>>>>>>> `traceroute login.physics.unc.edu' fails from Linerva because we can't
>>>>>>>> reach ns1.physics.unc.edu. to resolve it, but tracerouting 152.2.5.5
>>>>>>>> drops off after el-loco-v1627.net.unc.edu:
>>>>>>>>
>>>>>>>> 1 NW12-RTR-2-SIPB.MIT.EDU (18.181.0.1) 0.349 ms 0.352 ms 0.398 ms
>>>>>>>> 2 EXTERNAL-RTR-2-BACKBONE.MIT.EDU (18.168.0.27) 0.354 ms 0.417 ms 0.480 ms
>>>>>>>> 3 NY32-RTR-1-BACKBONE.MIT.EDU (18.168.0.34) 5.912 ms 5.976 ms 6.039 ms
>>>>>>>> 4 216.24.184.101 (216.24.184.101) 7.269 ms 7.279 ms 7.265 ms
>>>>>>>> 5 wash-newy-98.layer3.nlr.net (216.24.186.23) 11.822 ms 11.821 ms 11.806 ms
>>>>>>>> 6 dep7600-gw2-to-nlr-dc.ncren.net (128.109.70.101) 17.257 ms 17.197 ms 17.183 ms
>>>>>>>> 7 unc-manning-10G-to-dep7600-gw2.ncren.net (128.109.70.162) 18.321 ms 18.430 ms 18.510 ms
>>>>>>>> 8 el-loco-v1627.net.unc.edu (152.19.255.220) 18.042 ms 17.667 ms 17.668 ms
>>>>>>>> 9 * * *
>>>>>>>>
>>>>>>>> (mtr, using ICMP tracing, gets the same result).
>>>>>>>>
>>>>>>>> I see the same behavior for at least 152.2.5.4, 152.2.5.5, 152.2.5.15
>>>>>>>> (ns1.physics.unc.edu), 152.2.5.16 (ns6.physics.unc.edu), and 152.2.4.9
>>>>>>>> (www.panic.unc.edu).
>>>>>>>>
>>>>>>>> I've attached the output of 'ssh -vvv 152.2.5.5', but it's
>>>>>>>> uninteresting.
>>>>>>>>
>>>>>>>> - Nelson
>>>>>>>>
>>>>>>>> On Tue, Apr 07, 2009 at 12:05:31PM -0400, Stephen Joyce wrote:
>>>>>>>>> Hi Dee,
>>>>>>>>> Thanks for the heads-up.
>>>>>>>>>
>>>>>>>>> linerva admin:
>>>>>>>>> We use software which automatically blocks abusive hosts for a number of
>>>>>>>>> days. The 3rd such block is permanent. However each physics host does
>>>>>>>>> this independently and there is no block for anything in the 18.181 range
>>>>>>>>> on several hosts I checked.
>>>>>>>>>
>>>>>>>>> If a single host cannot ping anything in our subnet, I suspect a problem
>>>>>>>>> with that host's network configuration.
>>>>>>>>>
>>>>>>>>> The output of "traceroute login.physics.unc.edu", and "ssh -vvv
>>>>>>>>> login.physics.unc.edu" from 18.181.0.51 would be beneficial to see where
>>>>>>>>> the problem lies.
>>>>>>>>>
>>>>>>>>> PS. problem@physics only accepts email from unc.edu addresses by design;
>>>>>>>>> all our users have multiple unc.edu addresses.
>>>>>>>>>
>>>>>>>>> Cheers, Stephen
>>>>>>>>> --
>>>>>>>>> Stephen Joyce
>>>>>>>>> PANIC - Physics and Astronomy Network Infrastructure and Computing
>>>>>>>>> University of North Carolina at Chapel Hill
>>>>>>>>> voice: 919.962.7214
>>>>>>>>> fax: 919.962.0480
>>>>>>>>>
>>>>>>>>> A cubicle is just a padded cell without a door.
>>>>>>>>>
>>>>>>>>> On Tue, 7 Apr 2009, Dee Jarrell wrote:
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> FYI
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>>
>>>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>>
>>>>
>>>>
>>>> --
>>>>
>>>>
>>
>>
>> --
>>
>>
