Bot, psybnc ping timeout on webchat.org

[z0_redhat]

Hi,

I have an eggdrop bot, plus a psybnc connection that I used to run on the server webchat.org. Few days ago, they were both killed, and since then I'm unable to connect on webchat.org. After serveral telnet attempts, ping timeouts was the error that I got from the bot.

Thanks again, and hope to hear from you guys soon.

P.S I get that same issue with both Freebsd and Redhat.

[afonic]

Hi,

maybe the admins of that network have banned Polarhome's IP for some reason?

I would get in contact with them, most networks have lists of allowed bots/bnc and you need to apply to get added, otherwise you get k-lined.

[z0_redhat]

The ip isn't blacklisted or anything like that. I check with the guys earlier today.
They think its the bots, don't ping their server.

You can check the ip here.

[sjaz]

The IP isn't blocked by Spamhaus but that doesn't mean its not banned by network staff themselves.

I will if I have time later, discuss with one of their opers.

[sjaz]

Hi,

Having spoken with a member of their staff, they are confident it isn't on their side.

I have therefore done a bit of research and it seems polarhome has a problem reaching the IP in question.

From Redhat.polarhome.com

chaz@redhat~$ traceroute 216.152.66.48
traceroute to 216.152.66.48 (216.152.66.48), 30 hops max, 40 byte packets
1 gate.polarhome.com (192.168.10.1) 0.289 ms 0.276 ms 0.286 ms
2 1.31.227.87.static.dre.siw.siwnet.net (87.227.31.1) 35.447 ms 35.576 ms 37.425 ms
3 static-195.84.210.77.addr.se.sn.net (195.84.210.77) 42.883 ms 44.198 ms 44.175 ms
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
chaz@redhat~$ ping 216.152.66.48
PING 216.152.66.48 (216.152.66.48) 56(84) bytes of data.

--- 216.152.66.48 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms

And, from a working box (my home pc).

chaz@phantastia:~$ traceroute 216.152.66.48
traceroute to 216.152.66.48 (216.152.66.48), 30 hops max, 40 byte packets
1 speedtouch.lan (192.168.1.254) 63.763 ms 63.235 ms 62.717 ms
2 l1.ar10.f2s.hx4.dsl.pipex.net (62.241.161.237) 27.551 ms 29.261 ms 29.975 ms
3 ge-2-1-2.2.cr01.hx4.dsl.pipex.net (62.241.167.13) 32.354 ms 33.129 ms 35.708 ms
4 pc3-102.cr05.hx2.bb.pipex.net (62.72.139.21) 57.449 ms 59.181 ms 59.876 ms
5 195.66.226.185 (195.66.226.185) 43.356 ms 44.053 ms 46.561 ms
6 gi2-0-0.core02.lon01.atlas.cogentco.com (130.117.1.61) 48.287 ms 22.684 ms 23.329 ms
7 po9-0.core02.jfk02.atlas.cogentco.com (66.28.4.253) 213.151 ms 212.119 ms 212.066 ms
8 po12-0.core01.mci01.atlas.cogentco.com (154.54.3.202) 131.130 ms 124.866 ms 126.816 ms
9 po15-0.core01.den01.atlas.cogentco.com (154.54.3.13) 139.864 ms 139.083 ms 140.271 ms
10 po14-0.core01.smf01.atlas.cogentco.com (66.28.4.130) 160.896 ms 159.847 ms *
11 po4-0.core02.sfo01.atlas.cogentco.com (154.54.1.253) 163.136 ms 163.858 ms 164.833 ms
12 po15-0.core01.sfo01.atlas.cogentco.com (66.28.4.69) 158.068 ms 158.085 ms 167.658 ms
13 po4-0.core01.sjc01.atlas.cogentco.com (66.28.4.94) 176.986 ms 178.681 ms 179.307 ms
14 gi0-2.na01.b010910-0.sjc01.atlas.cogentco.com (38.20.33.6) 182.643 ms 183.337 ms 184.478 ms
15 Webmaster_Incorporated.demarc.cogentco.com (66.28.21.26) 190.917 ms 191.609 ms 194.490 ms
16 pool.webmaster.webchat.org (216.152.66.48) 196.537 ms 197.951 ms 199.400 ms
chaz@phantastia:~$ ping 216.152.66.48
PING 216.152.66.48 (216.152.66.48) 56(84) bytes of data.
64 bytes from 216.152.66.48: icmp_seq=1 ttl=50 time=163 ms
64 bytes from 216.152.66.48: icmp_seq=2 ttl=50 time=164 ms

--- 216.152.66.48 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 163.728/164.010/164.293/0.493 ms

Zoli?

[zoli]

Seems this is an ISP routing problem.

I'll send them a mail

[sjaz]

Thanks Z!

[z0_redhat]

Thanks you guys,

I'm still unable to connect, any luck on that mail Z?

[sjaz]

ISPs won't react that quickly unless there is a dire need.

Give the man a chance!

[zoli]

Hello,

unfortunately, the problem is not solved - but I can give you an update, at least.

I sent the problem to the ISP on 2007-12-17 22:01 and got an answer from them 2007-12-18 11:16 that everything is OK and this is confirmed by a technician.

I immediately replied that the problem still persists - but I haven't got any reply on that.

Meanwhile I have tested the polarhome's routing table (check the NEWS) and I could not find anything in routing and iptables chains that would cause such a failure.

Today 2007-12-19 morning I had a chat with the technical support of the customer service and they promised that they will investigate one more time.

During the afternoon I got a call from the ISP's sales department offering me some 4EUR off from the monthly cost
My answer was that I will accept the offer once they fix the outstanding network issues otherwise they will lose a customer.

Right after that I disconnect the whole polarhome and connected my laptop directly to the modem to 100% eliminate polarhome's weired ip rules. - and it did not work, that shows that the problem is clearly on the ISP's side.

I do not have more information, by now.

[sjaz]

Hi Z,

I have had some very odd connectivity issues into Polarhome (even outside of the NEWS). - Sometimes I can, other times I cannot get in from various locations.

[z0_redhat]

They ever get back with you guys on this issue, or is it ever going to be resolved?

I check connections once every other day but still no luck.

[zoli]

Hello,

I have bad news... the ISP again confirmed that it works for them - and an attachment:

Code: Select all

DRE-DR1.STO:1 # traceroute 85.0.106.188
traceroute to 85.0.106.188, 30 hops max

1 195.84.210.77 0 ms 0 ms 0 ms
2 194.68.128.116 0 ms 0 ms 0 ms
3 138.187.130.190 30 ms 30 ms 30 ms
4 138.187.129.86 30 ms 30 ms 30 ms
5 195.186.0.121 30 ms 30 ms 40 ms
6 195.186.0.98 30 ms 30 ms 30 ms
7 195.186.120.28 30 ms 30 ms 30 ms
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *


... but it does not work in reality

I will continue to complain - not just because of this tread, but I am personally interested in as well.

[/quote]

[z0_redhat]

Hi guys,

Z you mentioned goin to try contact webchat admins about the issue, any luck from them? Any idea if this ever going to be resolved?

You also said that both sides denied being the source of the whole mess, what would be the reason of hiding such thing.

Oh well, I just hope you get to the bottom of this, i'll be nice to know.

[z0_redhat]

Any luck regards to this thread yet? I checked with one of the webchat server admins about it and was told that they dont have any of polarhome ip(s) on any of their kill lists.

Z is this something you are still pursuing or did you gave up on it?

[zoli]

Hello,

seems ISP's block polarhome's IP because some well spread malware connects to some irc server hosted on polarhome.

As polarhome has many irc server and no ISP has given out the information to what port connects that malware - polarhome has no choice right now.

If malware resolves polarhome IP from a domain name - even the IP change would not help... and polarhome does not want to change the domain.

Well, this is the situation.
Once I get the port I can ban the user who have done this to polarhome - but that's it.

We simply need to learn to live with this

I am sorry for that.

[zoli]

Hello,

I guess this issue is solved now. Enjoy.

[z0_redhat]

Thanks Zoli for all your time. But I'm again, currently experiencing the same problem on webchat.

I checked with admins on the server and none of the ip(s) listed on their blacklist database.

[zoli]

Hello,

I have experienced as well, that some sites became unreachable again.

Last time we solved this with changing the IP address, because the ban is on IP address on some routing/network level - I guess because of malicious traffic, lot of spam etc from polarhome's IP.

I do not plan to change IP again... it is a rather costly alternative for abuse protection.

I do not have a solution yet... but soon I will do something for sure.

If you have any idea, please advice.