Greg K — Wed, 09 Nov 2005 16:23:37 +0000

What answers did pair give you about the problem? They are usually pretty good at getting something like that tracked down.

-Greg

New weirdness

rleesBSD — Wed, 09 Nov 2005 14:38:09 +0000

Well, this morning I am treated to some new random weirdness. A number of surfers from different countries have surfed to my site and each of them has downloaded only 32768 bytes of an 88,052 byte file. When I download the file myself, I get the full 88,052 bytes.

Ok, admittedly I sometimes see partial downloads from web-agents that are checking only for the existence of a file. But, in such cases, I never see a request for 32768 bytes. This morning, I have seen requests from four different IP addresses for only 32768 bytes.

- rleesBSD

Have used both ways

rleesBSD — Wed, 09 Nov 2005 05:21:22 +0000

Oh yea - sorry

Currently, I'm running the local machine with a local nameserver, but with Pair I used Pair nameservers, and with Spry I used Spry's nameservers.

Mark Hensler — Wed, 09 Nov 2005 04:48:43 +0000

That's interesting about your bot problems, but.... you forgot to answer Greg's question.

Greg K wrote: Are you actually setting up the domain name to use pair's nameservers, or you have your own and are setting your DNS servers to just use the IP # from pair.

Because you've jumped from host to host. It can't be a host issue. But I'm guessing you're using the same DNS provider? I see this as the only constant here. Plus, I find it interesting as to the timing of your traffic loss and typical DNS propogation time.

Web-host-provider

rleesBSD — Wed, 09 Nov 2005 04:23:05 +0000

Well, I am not necessarily saying that the web host provider is the problem. I am saying that a short term fix seems to be available simply by changing the IP address at the registrar - which is pretty weird. Normally, as time goes on and DNS propagates, one would expect an increase in traffic, not a decrease!

The Freshmeat episode occurred while I was running a server here at my location, via a Bellsouth connection. I don't know what happened to those thirteen URL clicks, because the packets from those users never reached my machine. It wasn't a server problem because the packets never reached the machine that the server is running on!

I know that is true, because while the Freshmeat incident was going on, I was simultaneously running a tcpdump log on the machines's interface, and there were no log entries for those thirteen user's clicks.

Some other weird things are going on. There seems to be a bot-net pinging me with UDP port 1026 data every minute. If I set the firewall to cloak a response, then the bots just keep on pinging away. But, if I set the firewall to send a reject response to the UDP, then immediately there is a download of my index.html file to a destination which is specified by a spoofed source. It seems that after that index.html download from the spoofed source packet, things get very quiet. At that point I know the traffic will be pretty much killed off.

Yet I don't notice anything funny about the packet that requested the index page, other than the source has been spoofed (when I look at the packet with the ethereal packet analyzer). Since the index page gets downloaded, I presume that a different node in the botnet takes the download. I don't see how that has any relationship to the decrease in my traffic ....

No, there is nothing "objectionable" on any of my sites .... only very tame "programming and software" related items.

Just thoroughly confused, at the moment ...

- rleesBSD

bja888 — Wed, 09 Nov 2005 03:29:48 +0000

You totally lost me somewhere in the first paragraph.
Idea - If the same thing keep happening consider the possbalilty its a server prublem and not a dns proublem.

Greg K — Wed, 09 Nov 2005 01:50:37 +0000

I use pairNetowrks myself, and have never had any problems such as this. Are you actually setting up the domain name to use pair's nameservers, or you have your own and are setting your DNS servers to just use the IP # from pair.

Another concideration, what type of site is it? Anything the hosting providers would find objectional? (of course, at least with pair, they would tell you this upfront).

I'm not really knowledgable in DNS settings, just giving what pops out to me as things to look for until someone who knows more might be able to answer you better.

-Greg