Hosting Issues - Hard to Understand

[Solecismic]

Hostway is admitting that there was an extended server outage, maybe a day or two in length, related to a DoS attack. My web site is on that particular server.

However, they keep saying that the outage has been fixed. My ticket was closed essentially talking about clearing browser caches.

But that's the first thing you think to do when coming off an outage, so I've cleared mine a couple of times. And tech support thought there was still a problem on their end earlier today.

I called again tonight. The support guy said he could view the site and there were no problems. He asked me to look through an anonymous proxy, something that I had tried earlier today and was unable to do. Tonight, the proxy works, though it's unusually slow.

When I try on a browser, I get the following error:

Connection Interrupted
The connection to the server was reset while the page was loading.
The network link was interrupted while negotiating a connection. Please try again

This is pointing to a block at my ISP's level. I can ping my web site, however, and run a traceroute. I can not ftp. I can surf to IP addresses adjacent to my server.

I think the odds of me calling a major cable company and being able to talk to them about an individual IP block is pretty much zero. And why would an ISP with millions of customers put a block on such a tiny space?

Any suggestions?

[Coder]

I realize this doesn't help you, but I can access the site without any trouble. This points to the fact that the problem is in fact, local. Could it also be a matter of your ISP's DNS-servers needing to reboot?

I'd say give it another 24 hours.

[Solecismic]

Originally Posted by Coder

I realize this doesn't help you, but I can access the site without any trouble. This points to the fact that the problem is in fact, local. Could it also be a matter of your ISP's DNS-servers needing to reboot?

I'd say give it another 24 hours.

If it were purely a local DNS issue, I would be unable to ping the site. And my browser would resolve by typing in the IP directly.

[Icy]

www.solecismic.com doesn't work for me either (ISP and IP from Spain), tried with firefox and Internet explorer. It justs hungs there for minutes, with he browser status bar showing "waiting for http://www.solecismic.com". So it's not your ISP, must be something in your host.

I can also ping and traceroute it, so in case they have stopped the DoS attack the problem might be related to Apache not working properly or the server or maybe the router being frozen or with a huge load after the DoS attack, so it can't serve your pages or let you login by FTP. I would ask for a router and/or server or at least Apache restart to see if it fixes it.

If it's not DoS related and you are in a virtual shared server, it could also be another of their customers in that server that has something running in his site/s that is freezing or overloading the server.

Anyway those are just guesses, hard to know without having shell access. Insist your host and tell them that your customers are also not being able to reach your site either so it's not your ISP or browser cache problem. Or they are still under attack, or the router/server is not working properly.

[Icy]

Umm after reading that Coder can reach it properly... maybe they have changed the site ip and we both have the old one catched so we are not loading the proper one. Please Coder post the ip you get.

This is the ip i get when i ping it:
Pinging www.solecismic.com [64.26.63.14] with 32 bytes of data:
Reply from 64.26.63.14: bytes=32 time=140ms TTL=45
Reply from 64.26.63.14: bytes=32 time=143ms TTL=45
Reply from 64.26.63.14: bytes=32 time=150ms TTL=45
Reply from 64.26.63.14: bytes=32 time=141ms TTL=45

Here are the last hops of a traceroute:
8 44 ms 56 ms 44 ms ge-6-0-0-dcr1.esx.cw.net [206.24.137.193]
9 55 ms 53 ms 43 ms so-7-0-0-dcr2.tsd.cw.net [195.2.9.145]
10 38 ms 39 ms 39 ms so-4-0-0-dcr1.lnd.cw.net [195.2.9.14]
11 39 ms 47 ms 41 ms xe-0-3-0.xcr1.lnd.cw.net [195.2.25.1]
12 59 ms 45 ms 45 ms ldn-b4-link.telia.net [213.248.75.169]
13 64 ms 70 ms 52 ms ldn-bb1-link.telia.net [80.91.249.131]
14 129 ms 112 ms 110 ms nyk-bb2-link.telia.net [80.91.248.254]
15 143 ms 142 ms 144 ms chi-bb1-link.telia.net [80.91.249.108]
16 151 ms 142 ms 138 ms hostway-115910-chi-bb1.c.telia.net [213.248.84.1
4]
17 131 ms 133 ms 139 ms 66.113.197.70
18 * * * Request timed out.
19 144 ms 158 ms 164 ms hostway-corp.ordx.hgtn.net [66.113.197.38]
20 141 ms 143 ms 144 ms lfw113.chi.us.siteprotect.com [66.113.128.101]
21 141 ms 145 ms 157 ms lsh202.chi.us.siteprotect.com [64.26.63.14]

Trace complete.

Notice the Request timed out at the hop #18.

It also catch my attention the last two hops related to siteprotect.com, maybe am i being redirected?

[Solecismic]

Thanks for replying. Yes, 64.26.63.14 is how my DNS is resolving the query. It would be interesting to know if those who can view the site get the same result. I think they will, though.

Siteprotect.com is where Hostway has all its servers, so that's normal. I also get a time out when I run the tracert, though mine is right when I hit my local ISP.

[Coder]

I can access www.solecismic.com with both Firefox and IE 7 from inside my company's network.. I cannot, however, ping www.solecismic.com (which resolved into the same IP-address both of you have listed), but this could have something to do with how our network is set up here (going through a proxy).

[Coder]

My thought was that Hostway had changed the IP after the attacks, and therefore all DNS-servers had to be updated. The one I'm using would have updated and gotten the new IP. However, since when I type in ping www.solecismic.com I still get the same IP as you makes this very strange..

[Coder]

Double dola (forgot the first dola)..

I can confirm that I can't get outside our own servers (it starts, but then times out on step two) with any traceroutes or pings from the network i'm inside, but the www.solecismic.com address resolves to 64.26.63.14

[Coder]

New update.. used a website to trace www.solecismic.com and got the following result:

1 gw-ext (192.168.243.254) 0.404 ms 0.369 ms 0.353 ms
2 ua-83-227-135-65.cust.bredbandsbolaget.se (83.227.135.65) 218.197 ms 144.221 ms 133.573 ms
3 ti3089d320-ge2-1-0.ti.telenor.net (146.172.85.225) 109.463 ms 108.843 ms 109.424 ms
4 * * *
5 ti3004c310-ae6-0.ti.telenor.net (146.172.99.194) 108.620 ms 108.053 ms 108.138 ms
6 ti9004b300-as0-0.ti.telenor.net (146.172.105.98) 108.586 ms 108.575 ms 109.079 ms
7 * * *
8 ve5.pr0.ordx.hgtn.net (66.113.197.30) 141.977 ms 142.883 ms 141.629 ms
9 hostway-corp.ordx.hgtn.net (66.113.197.38) 143.202 ms 143.485 ms 143.103 ms
10 lfw113.chi.us.siteprotect.com (66.113.128.101) 142.440 ms 143.438 ms 142.459 ms
11 lsh202.chi.us.siteprotect.com (64.26.63.14) 144.398 ms 142.203 ms 143.643 ms

[flere-imsaho]

An IP change does seem the most likely culprit. Solecismic.com is resolving just fine for me this morning (from work - remarkably not blocked by Websense ).

[gstelmack]

Page is coming up fine here. Same IP as listed above when pinged.

[Alan T]

Originally Posted by Icy

Umm after reading that Coder can reach it properly... maybe they have changed the site ip and we both have the old one catched so we are not loading the proper one. Please Coder post the ip you get.

This is the ip i get when i ping it:
Pinging www.solecismic.com [64.26.63.14] with 32 bytes of data:
Reply from 64.26.63.14: bytes=32 time=140ms TTL=45
Reply from 64.26.63.14: bytes=32 time=143ms TTL=45
Reply from 64.26.63.14: bytes=32 time=150ms TTL=45
Reply from 64.26.63.14: bytes=32 time=141ms TTL=45

Here are the last hops of a traceroute:
8 44 ms 56 ms 44 ms ge-6-0-0-dcr1.esx.cw.net [206.24.137.193]
9 55 ms 53 ms 43 ms so-7-0-0-dcr2.tsd.cw.net [195.2.9.145]
10 38 ms 39 ms 39 ms so-4-0-0-dcr1.lnd.cw.net [195.2.9.14]
11 39 ms 47 ms 41 ms xe-0-3-0.xcr1.lnd.cw.net [195.2.25.1]
12 59 ms 45 ms 45 ms ldn-b4-link.telia.net [213.248.75.169]
13 64 ms 70 ms 52 ms ldn-bb1-link.telia.net [80.91.249.131]
14 129 ms 112 ms 110 ms nyk-bb2-link.telia.net [80.91.248.254]
15 143 ms 142 ms 144 ms chi-bb1-link.telia.net [80.91.249.108]
16 151 ms 142 ms 138 ms hostway-115910-chi-bb1.c.telia.net [213.248.84.1
4]
17 131 ms 133 ms 139 ms 66.113.197.70
18 * * * Request timed out.
19 144 ms 158 ms 164 ms hostway-corp.ordx.hgtn.net [66.113.197.38]
20 141 ms 143 ms 144 ms lfw113.chi.us.siteprotect.com [66.113.128.101]
21 141 ms 145 ms 157 ms lsh202.chi.us.siteprotect.com [64.26.63.14]

Trace complete.

Notice the Request timed out at the hop #18.

It also catch my attention the last two hops related to siteprotect.com, maybe am i being redirected?

When you have a full hop that times out like that every single time, it usually does not necessarily mean there are issues with that hop (or otherwise you wouldn't have the ok response times from the hops beyond it). More accurately ooking at your trace route, connecting to that server from overseas, if this was my network I would say your connectivity looks just fine to the site. That hop with full timed out is more likely just a device in the path configured to not to respond to icmp protocol, or has a filter preventing those responses.

Based on your traceroute and the other responses in this thread, this does not seem to be a connectivity issue and I would expect something more local to the server, the application (http server in this case), or something along those lines (if the IP address you are trying to connect to is correctly being resolved by DNS.)

[lordscarlet]

Originally Posted by gstelmack

Page is coming up fine here. Same IP as listed above when pinged.

+1

It does not seem to be a server issue. Icy (and anyone else not able to reach the site), did you attempt to reach it while it was down?

This is very strange.

[Alan T]

Originally Posted by lordscarlet

+1

It does not seem to be a server issue. Icy (and anyone else not able to reach the site), did you attempt to reach it while it was down?

This is very strange.

Well the other possibility is the DoS attack is not occuring now as well, and if we had tried earlier in the morning we wouldn't have been able to connect either.

[Passacaglia]

Better get the FBI in on this one.

[Solecismic]

Originally Posted by Alan T

Well the other possibility is the DoS attack is not occuring now as well, and if we had tried earlier in the morning we wouldn't have been able to connect either.

They say it's resolved. I'm still unable to reach the site today.

If I had to guess, I'd say when they were fighting the attack, my ISP was blocked from the server.

[Solecismic]

It was still down when I posted 20 minutes ago. Now, for the first time in four days, I can see it without a proxy. Icy, has this changed for you?

[SackAttack]

Originally Posted by Solecismic

Thanks for replying. Yes, 64.26.63.14 is how my DNS is resolving the query. It would be interesting to know if those who can view the site get the same result. I think they will, though.

Siteprotect.com is where Hostway has all its servers, so that's normal. I also get a time out when I run the tracert, though mine is right when I hit my local ISP.

I'm getting it just fine and from that IP address (although just now is the first time I've checked the address).

Haven't had any issue loading the site.

[Icy]

Originally Posted by Solecismic

It was still down when I posted 20 minutes ago. Now, for the first time in four days, I can see it without a proxy. Icy, has this changed for you?

Site loads perfectly for me now too.