Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
On Tue, Mar 11, 2003 at 01:50:01PM +, [EMAIL PROTECTED] said: Remember: The majority of the posters here probably have roughly as much (but not as much) of an ego as you, yet a _lot_ more experience and skills to back it up. I think the results are Altho sometime I have to wonder especially with some of the recent posts. Perhaps clueful folk should sneak off and form nanog-clueful mailing list ;) Please don't; there are many of us lurking who are learning a great deal from listening in on the conversations of the clueful. -- Scott Francis || darkuncle (at) darkuncle (dot) net illum oportet crescere me autem minui pgp0.pgp Description: PGP signature
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
Emails to UUnet's NOC are unaswered and the guy I talked to on the phone @ UU wouldn't open a ticket because I'm not a customer (but his traces were dying in the same place as mine: 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) Can anybody out there hit that IP (208.196.93.204) at the moment? Or indeed much of anything in that /8 [C:\]ping 208.196.93.204 PING 208.196.93.204: 56 data bytes 208.196.93.204 PING Statistics 7 packets transmitted, 0 packets received, 100% packet loss [C:\]tracerte 208.196.93.204 0 192.168.1.1 (192.168.1.1) 0 ms 0 ms 0 ms [skip] 24 * [dies] [C:\]host 208.196.93.204 208.196.93.204 = ecobeauty.org And we are supposed to take The Ultimate Diagnosis from a person who would not think of using tcptrace, telnetting into port 80 or to see if that was an ACL? Phlease. Alex
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
DJR Date: Tue, 11 Mar 2003 14:01:51 +0700 DJR From: Dr. Jeffrey Race DJR [C:\]ping 208.196.93.204 DJR [C:\]host 208.196.93.204 1. You read the NANOG FAQ, yes? Please explain your post. 2. Did TCP attempts to various well-known ports stay in SYN_SENT, switch to CONNECTED, or return a RST? Or did you not try? Thanks for proving that experience in one sphere doesn't bring any free credibility in another. You posted what you should not, and gave the wrong answer at that. If you want to go around bragging i'm mad l33t, yo without skills to back it up, I suggest IRC as a better medium. Remember: The majority of the posters here probably have roughly as much (but not as much) of an ego as you, yet a _lot_ more experience and skills to back it up. I think the results are obvious. Consider being an early adopter of IPv8. Eddy -- Brotsman Dreger, Inc. - EverQuick Internet Division Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 (785) 865-5885 Lawrence and [inter]national Phone: +1 (316) 794-8922 Wichita ~ Date: Mon, 21 May 2001 11:23:58 + (GMT) From: A Trap [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to [EMAIL PROTECTED], or you are likely to be blocked.
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
Stephen J. Wilcox [EMAIL PROTECTED] wrote: posts. Perhaps clueful folk should sneak off and form nanog-clueful mailing list ;) S the'll all want one. Peter
RE: Issue with 208.192.0.0/8 - 208.196.93.0/24?
Brilliant. Why did not you try telnet target.ip 80? Just because random packets spewed by traceroute are dropped on the floor does not mean that the site is dead. As I stated to many in off-list mail last night, we were unable to get to that IP on any port. It was not just traceroute. My original email was indeed lacking in regard to suggesting cluefullness on my part. No need to beat on others because *I* tempted them into looking less than brilliant by not providing enough original info. The issue was sorted out after some offlist communication... once relevant info was communicated. Clients are happy and making transactions again just fine. My apologies again for any misunderstanding. Thanks again to those that helped out. --chuck I'm stapling this to a 2x4 and administering it to my forehead to remind me about proper communication with this group: -- traceroute is a disconcertingly blunt hammer; that we continue to use it to essentially nail moving jello to a wall says more about us than about anything on the Internet. --k claffy, At 8:43 -0700 10/17/02 on NANOG
RE: Issue with 208.192.0.0/8 - 208.196.93.0/24?
From your traceroute, you ascertain that the traffic is traversing the UUNET Backbone and is stopping just past the edge of the UUNET GW (Gateway) router as it leaves the UUNET Backbone. Thanks, Adam -Original Message- From: McBurnett, Jim [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 11, 2003 8:43 AM To: chuck goolsbee; [EMAIL PROTECTED] Subject: RE: Issue with 208.192.0.0/8 - 208.196.93.0/24? Is anyone from Alter.net lurking? Just for grins I went to the DIGEX looking glass and I could not ping it from MAE-Central, PAIX , MAE-East and also from ATT Cerf router below are some of the traces.. Always dies on Alter... I wonder. Alter? route-servertrac 208.196.93.204 Type escape sequence to abort. Tracing the route to ecobeauty.org (208.196.93.204) 1 mdf1-gsr12-1-gig-1-1.lax1.attens.net (12.129.192.237) [AS 17233] 0 msec 4 msec 0 msec 2 mdf1-gsr12-1-gig-1-1.lax1.attens.net (12.129.192.237) [AS 17233] 0 msec 0 msec 0 msec 3 gar3-p320.la2ca.ip.att.net (12.122.255.249) [AS 7018] 0 msec 4 msec 0 msec 4 gbr5-p90.la2ca.ip.att.net (12.123.28.193) [AS 7018] 4 msec 0 msec 0 msec 5 tbr2-p013501.la2ca.ip.att.net (12.122.11.153) [AS 7018] 4 msec 0 msec 4 msec 6 ggr1-p3100.la2ca.ip.att.net (12.122.11.222) [AS 7018] 0 msec 4 msec 4 msec 7 POS4-3.BR1.LAX9.ALTER.NET (204.255.168.61) [AS 701] 4 msec 4 msec 4 msec 8 0.so-0-1-0.XL2.LAX9.ALTER.NET (152.63.113.18) [AS 701] 4 msec 4 msec 4 msec 9 0.so-0-0-0.TL2.LAX9.ALTER.NET (152.63.115.146) [AS 701] 4 msec 4 msec 4 msec 10 0.so-6-0-0.TL2.NYC9.ALTER.NET (152.63.13.10) [AS 701] 76 msec 76 msec 76 msec 11 0.so-3-0-0.XL2.NYC1.ALTER.NET (152.63.29.113) [AS 701] 76 msec 76 msec 76 msec 12 0.so-0-0-0.XR2.NYC1.ALTER.NET (152.63.19.97) [AS 701] 76 msec 76 msec 76 msec 13 208.ATM7-0.GW11.NYC1.ALTER.NET (152.63.29.189) [AS 701] 76 msec 80 msec 76 mse c 14 * * * and it dies.. 03/11/03 08:28:24 Fast traceroute 208.196.93.204 Trace 208.196.93.204 ... 1 66.191.223.2 0ms0ms0ms TTL: 0 (cpe-66-191-223-002.spart.sc.charter.com ok) 2 66.168.32.41 0ms0ms0ms TTL: 0 (cpe-66-168-32-041.spart.sc.charter.com ok) 3 12.123.21.78 10ms0ms0ms TTL: 0 (gbr6-p80.attga.ip.att.net bogus rDNS: host not found [authoritative]) 4 12.122.12.25 10ms0ms0ms TTL: 0 (tbr1-p013601.attga.ip.att.net bogus rDNS: host not found [authoritative]) 5 12.122.12.30 0ms 10ms0ms TTL: 0 (ggr1-p340.attga.ip.att.net bogus rDNS: host not found [authoritative]) 6 204.255.174.149 0ms 10ms 10ms TTL: 0 (POS5-2.BR2.ATL5.ALTER.NET ok) 7 152.63.82.19410ms0ms 10ms TTL: 0 (0.so-2-3-0.XL2.ATL5.ALTER.NET ok) 8 152.63.10.106 0ms 10ms 10ms TTL: 0 (0.so-0-0-0.TL2.ATL5.ALTER.NET ok) 9 152.63.146.4220ms 20ms 20ms TTL: 0 (0.so-7-0-0.TL2.DCA6.ALTER.NET ok) 10 152.63.34.13020ms 20ms 20ms TTL: 0 (0.so-5-0-0.CL2.DCA1.ALTER.NET ok) 11 152.63.42.11030ms 20ms 20ms TTL: 0 (194.at-4-0-0.CL2.PHL1.ALTER.NET ok) 12 152.63.38.20120ms 20ms 30ms TTL: 0 (POS7-0.GW6.PHL1.ALTER.NET ok) And away to the bit bucket... -Original Message- From: chuck goolsbee [mailto:[EMAIL PROTECTED] Sent: Monday, March 10, 2003 10:14 PM To: [EMAIL PROTECTED] Subject: Issue with 208.192.0.0/8 - 208.196.93.0/24? Forgive the intrusion... We have a customer who uses some merchant services off of 208.196.93.204, which seems to be unreachable via any location I try. Emails to UUnet's NOC are unaswered and the guy I talked to on the phone @ UU wouldn't open a ticket because I'm not a customer (but his traces were dying in the same place as mine: 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) Can anybody out there hit that IP (208.196.93.204) at the moment? Or indeed much of anything in that /8? -- --chuck goolsbee geek wrangler, digital.forest inc, bothell, wa http://www.forest.net
RE: Issue with 208.192.0.0/8 - 208.196.93.0/24?
Easy, question.. Sure I could do that, I could run NMAP, Nessus, or any number of probes to check the validity of the host reachability. N-Stealth... and the list goes on. BUT if a host is denying pings from the world round and it stops trace a couple hops away maybe a BOGON filter or ACL or Well If I can't http to it, and I can't ping it from multiple peering points, there is a filter somewhere.. It can't even be accessed via the Worldcom UUNet network.. H.. Yeah you can telnet to it... Yeah I got to it via telnet... Anyway.. Normally if you can't Ping it and can't HTTP to a web server J -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 11, 2003 8:50 AM To: McBurnett, Jim Cc: chuck goolsbee; [EMAIL PROTECTED] Subject: RE: Issue with 208.192.0.0/8 - 208.196.93.0/24? Is anyone from Alter.net lurking? Just for grins I went to the DIGEX looking glass and I could not ping it from MAE-Central, PAIX , MAE-East and also from ATT Cerf router below are some of the traces.. Always dies on Alter... I wonder. Alter? Brilliant. Why did not you try telnet target.ip 80? Just because random packets spewed by traceroute are dropped on the floor does not mean that the site is dead. Alex
Issue with 208.192.0.0/8 - 208.196.93.0/24?
Forgive the intrusion... We have a customer who uses some merchant services off of 208.196.93.204, which seems to be unreachable via any location I try. Emails to UUnet's NOC are unaswered and the guy I talked to on the phone @ UU wouldn't open a ticket because I'm not a customer (but his traces were dying in the same place as mine: 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) Can anybody out there hit that IP (208.196.93.204) at the moment? Or indeed much of anything in that /8? -- --chuck goolsbee geek wrangler, digital.forest inc, bothell, wa http://www.forest.net
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
On Mon, 10 Mar 2003, chuck goolsbee wrote: Forgive the intrusion... We have a customer who uses some merchant services off of 208.196.93.204, which seems to be unreachable via any location I try. Emails to UUnet's NOC are unaswered and the guy I talked to on the phone @ UU wouldn't open a ticket because I'm not a customer (but his traces were dying in the same place as mine: traceroutes often die when there are firewalls and/or router acls 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) Can anybody out there hit that IP (208.196.93.204) at the moment? Or indeed much of anything in that /8? the /8 is kinda large for me to test 'right now' but this one /32 looks ok: xxx.corp.us.uu.net:t 208.196.93.204 80 Trying 208.196.93.204... Connected to 208.196.93.204 (208.196.93.204). Escape character is '^]'. That seems to be a good port 80 connection. route-server.ip.att.net shows this prefix as: BGP routing table entry for 208.196.93.0/24, version 107200 Paths: (19 available, best #19, table Default-IP-Routing-Table) Advertised to non peer-group peers: 12.161.130.230 7018 701 14462, (received used) Have you bothered to call ASN 14462 ? arin 14462 OrgName:EVS Holding Company, Inc. OrgID: EHC-8 Address:1415 RT 70, Suite 620 City: Cherry Hill StateProv: NJ PostalCode: 08034 Country:US ASNumber: 14462 ASName: CYSHOP-COMMERCE ASHandle: AS14462 Comment: RegDate:1999-12-16 Updated:1999-12-16 TechHandle: MB745-ARIN TechName: Byrnes, Michael TechPhone: +1-856-429-9249 TechEmail: [EMAIL PROTECTED] Perhaps Michael Byrnes is lurking and can help you? -- --chuck goolsbee geek wrangler, digital.forest inc, bothell, wa http://www.forest.net
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
OK... so I'm an idiot... end of a long day, apologies. The /8 was a jump to a bonehead conclusion on my part. The /24 IP in question remains unreachable on any port from here, but I did get enough offlist clueXfours to follow up offlist and soothe our client for the time being. Thanks folks, -- --chuck goolsbee geek wrangler, digital.forest inc, bothell, wa http://www.forest.net
Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
On Mon, 10 Mar 2003 19:14:07 -0800, chuck goolsbee wrote: Forgive the intrusion... Forgiven We have a customer who uses some merchant services off of 208.196.93.204, which seems to be unreachable via any location I try. Emails to UUnet's NOC are unaswered and the guy I talked to on the phone @ UU wouldn't open a ticket because I'm not a customer (but his traces were dying in the same place as mine: 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) Can anybody out there hit that IP (208.196.93.204) at the moment? Or indeed much of anything in that /8 [C:\]ping 208.196.93.204 PING 208.196.93.204: 56 data bytes 208.196.93.204 PING Statistics 7 packets transmitted, 0 packets received, 100% packet loss [C:\]tracerte 208.196.93.204 0 192.168.1.1 (192.168.1.1) 0 ms 0 ms 0 ms 1 192.168.1.1 (192.168.1.1) 0 ms 0 ms 8 ms 2 10.20.12.9 (10.20.12.9) 55 ms 55 ms 55 ms 3 ppp-203.144.161.5.revip.asianet.co.th (203.144.161.5) 39 ms 5 4 ppp-203.144.144.157.revip.asianet.co.th (203.144.144.157) 54 m ms 5 ppp-203.144.144.2.revip.asianet.co.th (203.144.144.2) 242 ms s 6 211.180.13.225 (211.180.13.225) 133 ms 133 ms 125 ms 7 210.120.192.136 (210.120.192.136) 133 ms 133 ms 132 ms 8 203.255.234.198 (203.255.234.198) 258 ms 203.255.234.210 (203. 266 ms 203.255.234.198 (203.255.234.198) 266 ms 9 203.255.234.36 (203.255.234.36) 250 ms 258 ms 258 ms 10 67.104.60.49 (67.104.60.49) 258 ms 258 ms 281 ms 11 p4-3-0.MAR2.Fremont-CA.us.xo.net (207.88.80.13) 258 ms 258 12 p4-0-0.RAR2.SanJose-CA.us.xo.net (65.106.5.137) 273 ms 266 13 p0-0-0-1.RAR1.SanJose-CA.us.xo.net (65.106.1.65) 266 ms 281 14 p0-0.IR1.PaloAlto-CA.us.xo.net (65.106.5.194) 273 ms 336 ms 15 206.111.12.150 (206.111.12.150) 265 ms 266 ms 258 ms 16 157.at-5-1-0.XR1.SAC1.ALTER.NET (152.63.51.58) 1031 ms 273 17 0.so-0-1-0.XL1.SAC1.ALTER.NET (152.63.53.241) 266 ms * 281 18 0.so-3-0-0.TL1.SAC1.ALTER.NET (152.63.53.250) 273 ms 274 ms 19 0.so-1-2-0.TL1.NYC9.ALTER.NET (152.63.10.77) 352 ms 335 ms 20 0.so-3-0-0.XL1.NYC1.ALTER.NET (152.63.27.29) 321 ms 321 ms 21 0.so-0-0-0.XR1.NYC1.ALTER.NET (152.63.19.85) 336 ms 336 ms 22 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185) 360 ms 352 m 23 * * * 24 * [dies] [C:\]host 208.196.93.204 208.196.93.204 = ecobeauty.org Jeffrey Race
