Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

numion.com - dziwne rzeczy... ?? HTTP/1.1 HEAD / conn reset by peer

17 views
Skip to first unread message

Jakub Wartak

unread,
Sep 19, 2006, 8:10:13 AM9/19/06
to
Witam,

mam zagadke:

test:~# wget http://www.numion.com/
--11:10:51-- http://www.numion.com/
=> `index.html'
Resolving www.numion.com... 80.69.70.75
Connecting to www.numion.com[80.69.70.75]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13,504 [text/html]

19% [======> ] 2,591 --.--K/s

11:10:51 (27.76 MB/s) - Read error at byte 2591/13504 (Connection reset by
peer). Retrying.

--11:10:52-- http://www.numion.com/
(try: 2) => `index.html'
Connecting to www.numion.com[80.69.70.75]:80... rconnected.
HTTP request sent, awaiting response... 206 Partial content
Length: 13,504 (10,913 to go) [text/html]

38% [+++++++======> ] 5,152 --.--K/s

11:10:53 (135.27 KB/s) - Read error at byte 5152/13504 (Connection reset by
peer). Retrying.

m --11:10:55-- http://www.numion.com/
(try: 3) => `index.html'
Connecting to www.numion.com[80.69.70.75]:80... connected.
HTTP request sent, awaiting response... 206 Partial content
Length: 13,504 (8,352 to go) [text/html]

57% [++++++++++++++======> ] 7,714 --.--K/s

11:10:55 (138.56 KB/s) - Read error at byte 7714/13504 (Connection reset by
peer). Retrying.

--11:10:58-- http://www.numion.com/
(try: 4) => `index.html'
Connecting to www.numion.com[80.69.70.75]:80... connected.
HTTP request sent, awaiting response... 206 Partial content
Length: 13,504 (5,790 to go) [text/html]

76% [+++++++++++++++++++++======> ] 10,276 --.--K/s

11:10:58 (136.64 KB/s) - Read error at byte 10276/13504 (Connection reset by
peer). Retrying.

I tak z kilku maszyn,

Systemy: FreeBSD 4.11 i 5.5, Linux 2.6.x ( kilka, gdzies na 5-ciu maszynach
testowane, wlaczenie/wylaczanie ECN nie pomaga ), ICMP PathMTU discovery
nie jest wyfiltrowane, OpenBSD to samo. Testowane wget/lynx/elinks.

O dziwo opera/9.01 tez mi tak wariuje, ale na tym samym laczu/kompie Mozilla
juz nie(??!)

Lacza testowane: TPSA neo+ , TPSA polpak-t w LB kilka lacz, TPSA idsl,
FUTURO, GTS, TKTELEKOM. Lacznosc bez zarzutu, tcpdump pokazuje ewidentnie
zerwanie ze strony serwera numiona ( TCP RST ). traceroute/mtr bardzo OK.

Routery od mojej strony: roznie, od Cisco przez jakies no-name po Linuxy
( adminuje wiekszoscia ), problem jedynie z numion.com, tam jest jakis IIS.
Nie ma transparentnego proxy, a jak jest o jest OK ( proxy chyba tak samo
dostaje ). Tez nie ma wycietego PMTUD.

A teraz najlepsze:

telnet numion.com 80
Trying 80.69.70.75...
Connected to numion.com.
Escape character is '^]'.
HEAD / HTTP/1.1
HConnection closed by foreign host.
Host
-su: Host: command not found
^^ oczywiscie ten sposob dziala na wszystkich innych serwerach...

telnet microsoft.com 80
Trying 207.46.250.119...
Connected to microsoft.com.
Escape character is '^]'.
HEAD / HTTP/1.1
Host: microsoft.com

HTTP/1.1 302 Object moved
Date: Tue, 19 Sep 2006 12:00:54 GMT
Server: Microsoft-IIS/6.0
Level: T3
X-Powered-By: ASP.NET
Location: http://www.microsoft.com
Content-Length: 145
Content-Type: text/html
Set-Cookie: ASPSESSIONIDQADRACBS=NBCGLGGDKMLDJNGAKEKJCLDN; path=/
Cache-control: private


echo -en "HEAD / HTTP/1.1\r\nHost: numion.com\r\n\r\n" | nc -vv numion.com
80
Connection to numion.com 80 port [tcp/http] succeeded!
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Content-Location: http://numion.com/index.html
Date: Tue, 19 Sep 2006 12:06:46 GMT
Content-Type: text/html
Accept-Ranges: bytes
Last-Modified: Tue, 22 Aug 2006 09:06:36 GMT
ETag: "324e4145cac5c61:193b"
Content-Length: 13504

Pomysly mi sie skonczyly... help.

--
Jakub Wartak
http://vnull.pcnet.com.pl/

Jakub Wartak

unread,
Sep 19, 2006, 8:20:29 AM9/19/06
to
Jakub Wartak wrote:

Poprawka: mozilla wlasnie tez przestala dawac rade, efekt identyczny z
Opera: nie do konca wgrany HTML, czesc sie renderuje. Jak jest transparent
to pisze ze connection reset by peer.

zlyZwierz

unread,
Sep 19, 2006, 10:45:19 AM9/19/06
to
Jakub Wartak wrote:
>
> Poprawka: mozilla wlasnie tez przestala dawac rade, efekt identyczny z
> Opera: nie do konca wgrany HTML, czesc sie renderuje. Jak jest transparent
> to pisze ze connection reset by peer.
>
>
U mnie działa :) 2xDSL via squid 2.6.3 ...


> przemekk@mobile ~ $ wget http://www.numion.com/
> --16:42:13-- http://www.numion.com/
> => `index.html'
> Translacja www.numion.com... 80.69.70.75
> Connecting to www.numion.com|80.69.70.75|:80... połączono.
> Żądanie HTTP wysłano, oczekiwanie na odpowiedź... 200 OK
> Długość: 13,504 (13K) [text/html]
>
> 100%[==================================================================>] 13,504 82.94K/s
>
> 16:42:14 (82.74 KB/s) - `index.html' saved [13504/13504]

Pozdrawiam

--

zUo

Jakub Wartak

unread,
Sep 19, 2006, 1:25:08 PM9/19/06
to
zlyZwierz wrote:

Wymieklem:

XXXXXX:~# tcpdump -s 0 -vni eth0 host ME and host 80.69.70.75 and tcp | grep
bad
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535
bytes
18:51:35.793639 IP (tos 0x0, ttl 120, id 26727, offset 0, flags [DF],
length: 52) 80.69.70.75.80 > 194.63.135.8.46864: . [bad tcp cksum dffe
(->8e64)!] ack 102 win 65484 <nop,nop,timestamp 10461560 1203292368>

18:51:39.711706 IP (tos 0x0, ttl 120, id 28129, offset 0, flags [DF],
length: 52) 80.69.70.75.80 > 194.63.135.8.46865: . [bad tcp cksum dffe
(->da2a)!] ack 102 win 65484 <nop,nop,timestamp 10461599 1203296285>

oczywiscie klasyfikowane to bylo jako INVALID dla conntracka i odrzucane...
z TCP/RST - poleglem.

Ale jak zrobie iptables -I INPUT -s numion.com -m state --state INVALID -j
ACCEPT to dziala........... jakby kernel nie odrzucal, czyli checksum dla
kernela byl dobry ale juz dla conntrackowej czesci kernela nie(?)

Chain INPUT (policy DROP 29 packets, 1751 bytes)
pkts bytes target prot opt in out source
destination
5 260 ACCEPT all -- * * 80.69.70.75
0.0.0.0/0 state INVALID
0 0 ACCEPT icmp -- * * 80.69.70.75
0.0.0.0/0
0 0 ACCEPT udp -- * * 80.69.70.75
0.0.0.0/0

juz pomijajc takie bzdurki jak ( -j LOG + pare opcji ):
IN=eth0 OUT= MAC=00:0e:0c:85:74:7d:00:e0:a3:22:d8:00:08:00 SRC=80.69.70.75
DST=JA LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=75 DF PROTO=TCP SPT=80
DPT=49290 SEQ=3652399068 ACK=746116987 WINDOW=65476 RES=0x00 ACK URGP=0 OPT
(0101080A009FC15847C53CFB)
^^^^ to OPT mnie dziwi...

Kernel dosyc stary ( 2.6.12.6 z kilkoma patchami backportowanymi ) ale jary
- jutro bede dalej debuggowal, moze cos wyskrobie wiecej.

pisz_n...@dionizos.zind.ikem.pwr.wroc.pl

unread,
Sep 19, 2006, 4:12:46 PM9/19/06
to
Jakub Wartak <spa...@drzewo.n0sp4m.pl> wrote:
> XXXXXX:~# tcpdump -s 0 -vni eth0 host ME and host 80.69.70.75 and tcp | grep
> bad
> tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535
> bytes
> 18:51:35.793639 IP (tos 0x0, ttl 120, id 26727, offset 0, flags [DF],
> length: 52) 80.69.70.75.80 > 194.63.135.8.46864: . [bad tcp cksum dffe
> (->8e64)!] ack 102 win 65484 <nop,nop,timestamp 10461560 1203292368>
>
> 18:51:39.711706 IP (tos 0x0, ttl 120, id 28129, offset 0, flags [DF],
> length: 52) 80.69.70.75.80 > 194.63.135.8.46865: . [bad tcp cksum dffe
> (->da2a)!] ack 102 win 65484 <nop,nop,timestamp 10461599 1203296285>


Potwierdzam, zawsze drugi pakiet z numiona jet walnięty:

I co ciekawe, wartość ta zależy od jakiś parametrów stosu

echo 0 > /proc/sys/net/ipv4/tcp_timestamps
cksum 0x419b (incorrect (-> 0x5b67)
cksum 0x419b (incorrect (-> 0xa664)

echo 1 > /proc/sys/net/ipv4/tcp_timestamps
cksum 0x41a7 (incorrect (-> 0x3eca)
cksum 0x41a7 (incorrect (-> 0xb34f)

Jakub Wartak

unread,
Sep 20, 2006, 4:41:49 AM9/20/06
to
zlyZwierz wrote:

A zrob:


iptables -I INPUT -s numion.com -m state --state INVALID -j

DROP

i zobacz jeszcze raz wgetem ( zakldam ze bedziesz mial moduly conntracka
zaladowane ).

zlyZwierz

unread,
Sep 20, 2006, 4:54:35 AM9/20/06
to
Jakub Wartak wrote:
>
> A zrob:
> iptables -I INPUT -s numion.com -m state --state INVALID -j
> DROP
>
> i zobacz jeszcze raz wgetem ( zakldam ze bedziesz mial moduly conntracka
> zaladowane ).
>

Dalej jest ok:

> Chain INPUT (policy DROP 46694 packets, 4715K bytes)


> pkts bytes target prot opt in out source destination

> 1 52 DROP all -- any any anywhere anywhere state INVALID
> 39267 51M ACCEPT all -- lo any anywhere anywhere
> 1135K 1188M ACCEPT all -- eth0 any anywhere anywhere state RELATED,ESTABLISHED


> przemekk@mobile ~ $ wget numion.com
> --10:51:53-- http://numion.com/
> => `index.html'
> Translacja numion.com... 80.69.70.75
> Connecting to numion.com|80.69.70.75|:80... połączono.


> Żądanie HTTP wysłano, oczekiwanie na odpowiedź... 200 OK
> Długość: 13,504 (13K) [text/html]
>

> 100%[==================================================================>] 13,504 --.--K/s
>
> 10:51:53 (133.61 KB/s) - `index.html' saved [13504/13504]

Pozdrawiam

--

zUo

Jakub Wartak

unread,
Sep 20, 2006, 5:21:38 AM9/20/06
to
zlyZwierz wrote:

Pomylilem sie z tym DROPem, jak widzisz u Ciebie tez lapie zly pakiet, ja na
fw robie cos takiego ( tzn bez -s numion.com ):

iptables -I INPUT -p tcp -s numion.com -m state --state INVALID -j REJECT
--reject-with tcp-reset

Teraz jak dostanie bledny checksum to odrzuci i zerwie polaczenie.... :/

0 new messages