LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 12-19-2006, 03:12 PM   #1
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Rep: Reputation: 15
ssh login weirdness


I used to be able to ssh using puTtY into my home computer from work. Now I just timeout when I try to connect.

However I can ssh into another remove machine, and then from there ssh into my home machine. At which point I notice my work domain is not responding to pings from my home machine but it is responding from the other remote machine.

What the heck does that mean? Why can I ssh in and get a response from one place but not the other?
 
Old 12-19-2006, 03:30 PM   #2
jakev383
QmailToaster Developer
 
Registered: Dec 2005
Location: Burlington, NC
Distribution: CentOS, Voyage, Debian, Fedora
Posts: 220

Rep: Reputation: 31
Quote:
Originally Posted by kav
I used to be able to ssh using puTtY into my home computer from work. Now I just timeout when I try to connect.

However I can ssh into another remove machine, and then from there ssh into my home machine. At which point I notice my work domain is not responding to pings from my home machine but it is responding from the other remote machine.

What the heck does that mean? Why can I ssh in and get a response from one place but not the other?
Sounds like something firewall related, which could be on either end. If you don't run the work network maybe someone saw a long-time connection to your home IP and blocked it. Are you running anything on your home machine that may have blocked the incoming connection from your work IP?
 
Old 12-19-2006, 03:38 PM   #3
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Original Poster
Rep: Reputation: 15
At first I thought my ip might have changed and the old ip was still stuck in a dns cache somewhere, but I've manually typed the ip in from both ends in ping attempts and never get anything back.

I am running snort at home. But does that application alone have the authority to start blocking ip's? Maybe you're right and someone at work blocked me or I tripped some automatic IDS trigger on a fire wall or something. I'll have to ask around. Thanks
 
Old 12-19-2006, 04:12 PM   #4
jakev383
QmailToaster Developer
 
Registered: Dec 2005
Location: Burlington, NC
Distribution: CentOS, Voyage, Debian, Fedora
Posts: 220

Rep: Reputation: 31
Quote:
Originally Posted by kav
At first I thought my ip might have changed and the old ip was still stuck in a dns cache somewhere, but I've manually typed the ip in from both ends in ping attempts and never get anything back.

I am running snort at home. But does that application alone have the authority to start blocking ip's? Maybe you're right and someone at work blocked me or I tripped some automatic IDS trigger on a fire wall or something. I'll have to ask around. Thanks
Depends on how you set up Snort. Normally, no.
Maybe do a traceroute to your home machine and see where it gets broken?
But I'd bet on the IP being blocked at work. I've been known to do similar things on the network here, but I was mandated to allow ANYONE to install ANYTHING they wanted, so trojans and what-not are rampant there.
 
Old 12-19-2006, 09:17 PM   #5
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Original Poster
Rep: Reputation: 15
here's what I got from traceroute on my home machine targeting work:

# traceroute sysintegration.com
traceroute to sysintegration.com (207.59.87.178), 30 hops max, 40 byte packets
1 mail.sysintegration.com (207.59.87.178) 0.905 ms 0.641 ms 0.577 ms
2 mail.sysintegration.com (207.59.87.178) 6.011 ms 4.788 ms 4.811 ms
3 mail.sysintegration.com (207.59.87.178) 6.351 ms 5.094 ms 4.733 ms
4 mail.sysintegration.com (207.59.87.178) 7.435 ms 7.262 ms 7.467 ms
5 mail.sysintegration.com (207.59.87.178) 7.506 ms 17.329 ms 7.467 ms
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *

Does that mean anything in particular to you? I've never used traceroute before. I'll get it from the other direction first thing tomarrow. Thanks for your help.
 
Old 12-20-2006, 07:33 AM   #6
jakev383
QmailToaster Developer
 
Registered: Dec 2005
Location: Burlington, NC
Distribution: CentOS, Voyage, Debian, Fedora
Posts: 220

Rep: Reputation: 31
Quote:
Originally Posted by kav
here's what I got from traceroute on my home machine targeting work:

# traceroute sysintegration.com
traceroute to sysintegration.com (207.59.87.178), 30 hops max, 40 byte packets
1 mail.sysintegration.com (207.59.87.178) 0.905 ms 0.641 ms 0.577 ms
2 mail.sysintegration.com (207.59.87.178) 6.011 ms 4.788 ms 4.811 ms
3 mail.sysintegration.com (207.59.87.178) 6.351 ms 5.094 ms 4.733 ms
4 mail.sysintegration.com (207.59.87.178) 7.435 ms 7.262 ms 7.467 ms
5 mail.sysintegration.com (207.59.87.178) 7.506 ms 17.329 ms 7.467 ms
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *

Does that mean anything in particular to you? I've never used traceroute before. I'll get it from the other direction first thing tomarrow. Thanks for your help.
What it's telling you is what computers/routers you're actually going through to get to your home computer. Each hop should be a diferent router. Whats weird here is that you're showing multiple hops on the same machine....
 
Old 12-20-2006, 08:03 AM   #7
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by jakev383
Whats weird here is that you're showing multiple hops on the same machine....
Whenever I traceroute anything from either the home or the remote machine I get almost the same feed back from just 1 address. identical addresses for 10 or 15 lines and then just * * * after that till 30.

If it's weird what does it mean? What should I do about it?
 
Old 12-20-2006, 09:41 AM   #8
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Original Poster
Rep: Reputation: 15
when I traceroute from the remote machine to my home computer all I get are 30 lines of " * * * " what does that mean?

Here is the trace from work to home:

1 ftp.64.0.105 (126.110.251.245) 0.424 ms 0.412 ms 0.383 ms
2 207.59.87.177 (207.59.87.177) 1.018 ms 0.956 ms 0.922 ms
3 199.72.235.41 (199.72.235.41) 7.060 ms 7.850 ms 7.449 ms
4 ge-1-1-0-300.core1.tycrva03.uslec.net (169.130.97.1) 5.450 ms 5.284 ms 5.188 ms
5 169.130.81.66 (169.130.81.66) 7.508 ms 7.551 ms 7.450 ms
6 so-0-3-0.core1.rlghnczy.uslec.net (169.130.81.82) 24.074 ms 24.063 ms 24.231 ms
7 ge-0-1-0-0.core2.rlghnczy.uslec.net (169.130.81.122) 24.148 ms 24.036 ms 24.274 ms
8 so-0-2-0.core2.chrxncrx.uslec.net (169.130.80.53) 28.357 ms 28.508 ms 28.582 ms
9 ge-0-0-0-0.core1.chrxncrx.uslec.net (207.59.119.89) 28.571 ms 28.365 ms 28.664 ms
10 169.130.81.70 (169.130.81.70) 33.960 ms 33.687 ms 34.015 ms
11 ge-0-1-0-0.core1.atlagamv.uslec.net (207.59.119.18) 33.824 ms 34.008 ms 33.937 ms
12 pos4-1.gw1.atl4.alter.net (157.130.68.9) 33.431 ms 33.808 ms 33.425 ms
13 0.so-1-0-0.xl1.atl4.alter.net (152.63.86.82) 33.334 ms 33.980 ms 33.597 ms
14 0.so-4-0-0.cl1.tpa2.alter.net (152.63.81.242) 69.997 ms 65.506 ms 49.417 ms
15 0.so-0-0-0.tpa01-peer-rtr1.verizon-gni.net (152.63.80.18) 49.687 ms 49.517 ms 49.427 ms
16 130.81.17.182 (130.81.17.182) 50.475 ms 50.239 ms 50.283 ms
17 so-6-2-0-0.bb-rtr2.res.verizon-gni.net (130.81.19.42) 52.272 ms 52.209 ms 52.548 ms
18 p15-0.lcr-02.washdc.verizon-gni.net (130.81.28.198) 52.782 ms 52.641 ms 52.760 ms
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

Is there anything else I can check to try and figure this thing out?
 
Old 12-21-2006, 09:50 AM   #9
jakev383
QmailToaster Developer
 
Registered: Dec 2005
Location: Burlington, NC
Distribution: CentOS, Voyage, Debian, Fedora
Posts: 220

Rep: Reputation: 31
Quote:
Originally Posted by kav
when I traceroute from the remote machine to my home computer all I get are 30 lines of " * * * " what does that mean?

Is there anything else I can check to try and figure this thing out?
Those are normally lost packets in the hops.
Try doing a traceroute to the middle machine you've been using to log into your home machine, and see if it's taking a different route than the traceroute directly to your home machine shows.
 
Old 12-23-2006, 01:28 AM   #10
kav
Member
 
Registered: May 2006
Location: USA
Distribution: FreeBSD Ubuntu Debian
Posts: 133

Original Poster
Rep: Reputation: 15
As of today all of a sudden my pings get through, the website is accessible and I can ssh directly. I changed nothing. Assuming I was blocked by the firewall's IDS, do some of them have a timer on ip blocks? Other than that I can't imagine what could possibly have been causing this. Given the inconsistency of the problem, nothing else seems to make sense.
 
Old 12-26-2006, 05:59 AM   #11
jakev383
QmailToaster Developer
 
Registered: Dec 2005
Location: Burlington, NC
Distribution: CentOS, Voyage, Debian, Fedora
Posts: 220

Rep: Reputation: 31
Quote:
Originally Posted by kav
As of today all of a sudden my pings get through, the website is accessible and I can ssh directly. I changed nothing. Assuming I was blocked by the firewall's IDS, do some of them have a timer on ip blocks? Other than that I can't imagine what could possibly have been causing this. Given the inconsistency of the problem, nothing else seems to make sense.
Quite possible. Depends on what you have setup, and how you configured it. You also have to take into consideration that your office network may have been changed. If you started asking the right questions the IT guys might have realized they blocked some legit traffic and changed the firewall there as well.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SSH weirdness sardaukar_siet Linux - Networking 2 11-07-2006 03:31 PM
Undef handle weirdness in Net::SSH::Perl PenguinPwrdBox Programming 0 07-11-2006 01:11 PM
ssh login rickylim *BSD 7 04-03-2006 02:55 AM
login weirdness after dist-upgrade rosslaird Debian 9 07-30-2004 04:00 PM
ftp login -- ssh no login waffe Linux - General 4 12-27-2003 12:42 AM


All times are GMT -5. The time now is 08:54 AM.

Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration