can not visit specific website?

[kakakaka77]

Hi,
I can not browse

http://www.tangohosting.com

webiste in my office.
But I can browse it from other computer using other network.
I am pretty sure I did not block this website, or set it as restricted site.

It sounds there is something wrong with my internet service. I checked with ISP, and they said everything is fine.
I can open other websites without any problem.


So, anybody has any thought of what the problem would be?

Thank you!

 

[Noway2]

I just opened the link just fine. You might want to try running a traceroute (tracert on Windows) to it and see if you are losing the connection anywhere. I would also try doing an nslookup on the domain and see if you are resolving to the proper IP address.

 

[kakakaka77]

Thank you for the reply!

I just run a traceroute, info as following :

Tracing route to

http://www.tangohosting.com

[205.134.226.5]
over a maximum of 30 hops:

1 1 ms 1 ms 1 ms 192.168.1.1
2 2 ms 1 ms 1 ms h-74-3-44-177.lsanca54.static.covad.net [74.3.44.177]
3 31 ms 15 ms 15 ms 172.24.0.1
4 12 ms 9 ms 22 ms 192.168.29.137
5 14 ms 9 ms 9 ms 67.100.36.21-ge3.4-lsan-osr2-los-angeles.covad.com [67.100.36.21]
6 22 ms 16 ms 14 ms 206.223.143.2
7 15 ms 9 ms 15 ms 67.199.135.170
8 26 ms 12 ms 10 ms 66.117.11.59
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.



I have called my ISP(COVAD), they did not really solve my problem, just said it is working fine on their site. I can ping that last ip where the request stops (66.117.11.59
), but not the

http://www.tangohosting.com

[205.134.226.5]


Have any thought?

 

[Noway2]

It looks like your traffic may be being blocked by 66.117.11.59, or at least that is the last hop that you are getting a ICMP response from. I just ran a traceroute too and it stops at the same place. I have attached a .pdf to this thread with the whois information for their owner in case you wish to contact them. Unfortunately, this suggests that this is not the problem.

Is it possible that your work location, from which you are experiencing the trouble, is using a form of content sensitive filtering or a domain black list (category - hosting (this was blocked at my last employer))?

 

[Noway2]

DOH, forgot the attachment....

 

[kakakaka77]

Ok, after several calls and emails, tangohosting said they blocked my IP. And after they took off my IP from the block list, everything is going well now.

Thank you for your reply, Noway2!

 

[Noway2]

tangohosting said they blocked my IP

... Shaking my head ....

I am glad that it is straightened out now. Out of curiosity, did they say why they would do such a thing?

 

[kakakaka77]

Ok, this just happens again!!! I can not browse it again.

After I sent them an email, they told me :

"Your IP address has been permanently block in our core firewall because your router/switch/firewall/system at that IP address is a security risk to our network, until this is fixed we will not remove the block. Below are some security alerts and notices just from this morning; we have noted 1000's or other this year. Drops due to Malformed or unhandled IP packets indicated that the device is miss configured, failing or attempting to hack our network."

1 11/04/2010 11:08:05.320 Notice Network Access ICMP packet dropped due to policy 74.3.44.179, 768, X1 205.134.226.201, 8, X0 ICMP Echo, Code: 0
2 11/04/2010 11:09:04.288 Notice Network Access ICMP packet dropped due to policy 74.3.44.179, 768, X1 205.134.226.201, 8, X0 ICMP Echo, Code: 0
3 11/04/2010 08:19:41.512 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
4 11/04/2010 08:25:20.064 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
5 11/04/2010 08:36:05.464 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
6 11/04/2010 08:51:18.416 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
7 11/04/2010 08:58:34.704 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
8 11/04/2010 09:29:01.848 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
9 11/04/2010 09:44:13.848 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
10 11/04/2010 09:59:25.752 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
11 11/04/2010 10:14:36.864 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
12 11/04/2010 10:23:59.592 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
13 11/04/2010 10:37:48.848 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
14 11/04/2010 10:53:01.688 Alert Network Access Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41
15 11/04/2010 11:09:12.272 Notice Network Access Web access request dropped 74.3.44.179, 49463, X1 205.134.226.201, 80, X0 TCP HTTP 1
16 11/04/2010 11:08:13.144 Notice Network Access TCP connection dropped 74.3.44.179, 3933, X1 205.134.226.201, 445, X0 TCP SMB 1
17 11/04/2010 11:08:42.736 Notice Network Access UDP packet dropped 74.3.44.179, 137, X1 205.134.226.201, 137, X0 UDP NetBios NS UDP 1

Thank you,

Support Team
Tango Hosting, LLC



I do not know what they mean by "a security risk to our network".

 

[Noway2]

This looks like the output of a Sonic Firewall. It is reporting bad connections between your machine and theirs. From the log they provided, there are a few oddities that you will need to look into. It is possible that you have some malware doing things that it shouldn't be and that this is the cause of your problem. It is also possible that you have an equipment problem that is causing dropped packets.

The first two lines are PING requests (ICMP echo), which apparently they block by policy. This explains why we couldn't PING them.

Malformed or unhandled IP packet dropped 74.3.44.179, 0, X1 205.134.226.201 IP Protocol 41

Now this one gets interesting. First off, your machine appears to be using port 0 outbound. I am not sure if this is legal or not. Then you are trying to access port 41, which is designated as IPV6 tunneling via IPV4. I am really not sure what that is all about, but it looks weird.

15 11/04/2010 11:09:12.272 Notice Network Access Web access request dropped 74.3.44.179, 49463, X1 205.134.226.201, 80, X0 TCP HTTP 1
16 11/04/2010 11:08:13.144 Notice Network Access TCP connection dropped 74.3.44.179, 3933, X1 205.134.226.201, 445, X0 TCP SMB 1
17 11/04/2010 11:08:42.736 Notice Network Access UDP packet dropped 74.3.44.179, 137, X1 205.134.226.201, 137, X0 UDP NetBios NS UDP 1

The first of these is your being blocked from their website. The next two are also interesting. Your machine is trying to make Netbios and SMB connections to their network. I don't know of legitimate reasons why your system would do this, but it appears to be a common Windows 'cracker' technique.

You will need to determine what is causing this strange traffic.