Bizarre router issue

Traceroutes and pings work but applications timeout.

I have a Fedora Core 3 box set up as a router. We work on equipment from
various sites so I multi-home the Network card in the Fedora box so I
don't have to change IPs. I have a USR8200 set up as the Internet gateway
and as the default router for the Fedora box. There are various Solaris,
Windows 2000/XP and Linux boxes in the office all of which are set with
the Fedora box as the default router. Everything was working fine. I was
messing around setting up a USB modem on the Fedora box this morning for
dialin access and I rebooted it. After it came back up no applications on
any of the Windows boxes could access the Internet. The Linux and Solaris
boxes work fine. You can do traceroutes and pings to anything on the
Internet (including DNS names) from the Windows boxes and they work fine
but any applications (Eudora, Firefox, IE) on the Windows boxes timeout
when trying to access the Internet. How can traceroutes work but the
applications don't? Also if I switch the gateway on the Windows boxes to
the USR8200 they work.

Ron Albright schreef:
> Traceroutes and pings work but applications timeout.
>
> I have a Fedora Core 3 box set up as a router. We work on equipment from
> various sites so I multi-home the Network card in the Fedora box so I
> don't have to change IPs. I have a USR8200 set up as the Internet gateway
> and as the default router for the Fedora box. There are various Solaris,
> Windows 2000/XP and Linux boxes in the office all of which are set with
> the Fedora box as the default router. Everything was working fine. I was
> messing around setting up a USB modem on the Fedora box this morning for
> dialin access and I rebooted it. After it came back up no applications on
> any of the Windows boxes could access the Internet. The Linux and Solaris
> boxes work fine. You can do traceroutes and pings to anything on the
> Internet (including DNS names) from the Windows boxes and they work fine
> but any applications (Eudora, Firefox, IE) on the Windows boxes timeout
> when trying to access the Internet. How can traceroutes work but the
> applications don't? Also if I switch the gateway on the Windows boxes to
> the USR8200 they work.

Could this be a DNS issue? Do you use names or addresses with the pings
and traceroutes?

--
Max

Open Source is an ode to common sense

On Tue, 08 Feb 2005 22:11:33 +0100, Max wrote:
>
> Could this be a DNS issue? Do you use names or addresses with the pings
> and traceroutes?

Both. I did tracert to www.weather.com, www.google.com, both outside
DNS srever IPs and the IP of my gateway at home. All worked fine.

Ron Albright schreef:
> On Tue, 08 Feb 2005 22:11:33 +0100, Max wrote:
>
>>Could this be a DNS issue? Do you use names or addresses with the pings
>>and traceroutes?
>
>
> Both. I did tracert to www.weather.com, www.google.com, both outside
> DNS srever IPs and the IP of my gateway at home. All worked fine.

So for some reason your Fedora box is blocking port 80 forwards, do you
have iptables configured by any change?

--
Max

Open Source is an ode to common sense

Ron Albright wrote:
> Traceroutes and pings work but applications timeout.
>
> I have a Fedora Core 3 box set up as a router. We work on equipment from
> various sites so I multi-home the Network card in the Fedora box so I
> don't have to change IPs. I have a USR8200 set up as the Internet gateway
> and as the default router for the Fedora box. There are various Solaris,
> Windows 2000/XP and Linux boxes in the office all of which are set with
> the Fedora box as the default router. Everything was working fine. I was
> messing around setting up a USB modem on the Fedora box this morning for
> dialin access and I rebooted it. After it came back up no applications on
> any of the Windows boxes could access the Internet. The Linux and Solaris
> boxes work fine. You can do traceroutes and pings to anything on the
> Internet (including DNS names) from the Windows boxes
A subsequent post of yours says you were using tracert. Traceroute uses
UDP; I believe tracert uses ICMP. This may be a significant difference.

Anyway, I'd suggest starting up your favorite packet sniffer on the
output interface of the Fedora box. Then telnet to port 80 on something
like google.com from a Linux or Solaris box. When (if) that works, try
the same trick from a Windows box. See if you see any traffic. See if
it's different. If that doesn't work, pick another port (e.g. ftp) that
should be open and try that. (I assume you're checked that iptables
isn't getting in your way.)

On Wed, 09 Feb 2005 00:09:26 +0100, Max wrote:

>
> So for some reason your Fedora box is blocking port 80 forwards, do you
> have iptables configured by any change?

But only from Windows boxes not from Linux or Solaris boxes.

Ron Albright schreef:
> On Wed, 09 Feb 2005 00:09:26 +0100, Max wrote:
>
>
>>So for some reason your Fedora box is blocking port 80 forwards, do you
>>have iptables configured by any change?
>
>
> But only from Windows boxes not from Linux or Solaris boxes.

Yes, sorry I was reading to quick so I missed that point..

If you use your Fedora box as default gateway for the windows boxes, can
you see traffic from their browsers with tcpdump or any other tool to
check network activity?

--
Max

Open Source is an ode to common sense

On Tue, 08 Feb 2005 19:19:57 -0500, Allen McIntosh wrote:

> A subsequent post of yours says you were using tracert. Traceroute uses
> UDP; I believe tracert uses ICMP. This may be a significant difference.

tracert on Windows traceroute on Linux and Solaris. I wasn't aware there
was a difference. I always thought tracert was just a Windows port of
traceroute. Good to know.

>
> Anyway, I'd suggest starting up your favorite packet sniffer on the
> output interface of the Fedora box. Then telnet to port 80 on something
> like google.com from a Linux or Solaris box. When (if) that works, try
> the same trick from a Windows box. See if you see any traffic. See if
> it's different. If that doesn't work, pick another port (e.g. ftp) that
> should be open and try that.

I did some snoops which I included below (the names have been change to
protect the innocent... err... I mean my network). It doesn't make much
sense. It looks like there is an initial exchange between doberman
(windows box) and google.com http port. But after the first exchange of
packets the Windows box starts sending packets to a completely erroneous
address for no reason that I can see. I only included the first but the
Windows box keeps trying to talk to 239.255.255.250. The snoops on the
Linux box hitting google looked normal.

>(I assume you're checked that iptables
> isn't getting in your way.)

I'm no iptables guru but it looks correct to me. This box has no exposer
outside the firewall. Also if iptables was the problem why would it only
only block the Windows boxes? I know you can do some pretty magical stuff
with iptables but I wasn't aware they added filters for Windows OSes :-)
(although thinking about it that could be a handy feature). iptables -L
listing is below.

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 2 arrived at 11:41:23.21
ETHER: Packet size = 62 bytes
ETHER: Destination = 1:1:1:1:1:1,
ETHER: Source = 1:1:1:1:1:2,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 48 bytes
IP: Identification = 44579
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 127 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 138c
IP: Source address = 10.33.51.148, doberman.domainname.com
IP: Destination address = 64.233.187.104, 64.233.187.104
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 2059
TCP: Destination port = 80 (HTTP)
TCP: Sequence number = 1997144279
TCP: Acknowledgement number = 0
TCP: Data offset = 28 bytes
TCP: Flags = 0x02
TCP: ..0. .... = No urgent pointer
TCP: ...0 .... = No acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 65535
TCP: Checksum = 0xc992
TCP: Urgent pointer = 0
TCP: Options: (8 bytes)
TCP: - Maximum segment size = 1260 bytes
TCP: - No operation
TCP: - No operation
TCP: - SACK permitted option
TCP:
HTTP: ----- HTTP: -----
HTTP:
HTTP: ""
HTTP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 3 arrived at 11:41:23.31
ETHER: Packet size = 60 bytes
ETHER: Destination = 1:1:1:1:1:3,
ETHER: Source = 1:1:1:1:1:1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 44 bytes
IP: Identification = 30370
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 239 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 1b11
IP: Source address = 64.233.187.104, 64.233.187.104
IP: Destination address = 10.33.51.148, doberman.domainname.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 80
TCP: Destination port = 2059
TCP: Sequence number = 1710960700
TCP: Acknowledgement number = 1997144280
TCP: Data offset = 24 bytes
TCP: Flags = 0x12
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 8190
TCP: Checksum = 0x2853
TCP: Urgent pointer = 0
TCP: Options: (4 bytes)
TCP: - Maximum segment size = 1260 bytes
TCP:
HTTP: ----- HTTP: -----
HTTP:
HTTP: ""
HTTP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 6 arrived at 11:42:14.31
ETHER: Packet size = 60 bytes
ETHER: Destination = 1:1:1:1:1:4, (multicast)
ETHER: Source = 1:1:1:1:1:3,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 24 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 32 bytes
IP: Identification = 44904
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 1 seconds/hops
IP: Protocol = 2 (IGMP)
IP: Header checksum = 47ae
IP: Source address = 10.33.51.148, doberman.domainname.com
IP: Destination address = 239.255.255.250, 239.255.255.250
IP: Options: (4 bytes)
IP: - Option 148 (unknown - 4 bytes) 0000
IP:

ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 7 arrived at 11:42:14.31
ETHER: Packet size = 74 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 1:1:1:1:1:6,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 60 bytes
IP: Identification = 44904
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 150 seconds/hops
IP: Protocol = 1 (ICMP)
IP: Header checksum = fb56
IP: Source address = 10.33.50.8, linksysw1.domainname.com
IP: Destination address = 10.33.51.148, doberman.domainname.com
IP: No options
IP:
ICMP: ----- ICMP Header -----
ICMP:
ICMP: Type = 3 (Destination unreachable)
ICMP: Code = 2 (Bad protocol 2)
ICMP: Checksum = a6d8
ICMP:
ICMP: [ subject header follows ]
ICMP:
ICMP:IP: ----- IP Header -----
ICMP:IP:
ICMP:IP: Version = 4
ICMP:IP: Header length = 24 bytes
ICMP:IP: Type of service = 0x00
ICMP:IP: xxx. .... = 0 (precedence)
ICMP:IP: ...0 .... = normal delay
ICMP:IP: .... 0... = normal throughput
ICMP:IP: .... .0.. = normal reliability
ICMP:IP: Total length = 32 bytes
ICMP:IP: Identification = 44904
ICMP:IP: Flags = 0x0
ICMP:IP: .0.. .... = may fragment
ICMP:IP: ..0. .... = last fragment
ICMP:IP: Fragment offset = 0 bytes
ICMP:IP: Time to live = 1 seconds/hops
ICMP:IP: Protocol = 2 (IGMP)
ICMP:IP: Header checksum = 47ae
ICMP:IP: Source address = 10.33.51.148, doberman.domainname.com
ICMP:IP: Destination address = 239.255.255.250, 239.255.255.250
ICMP:IP: Options: (4 bytes)
ICMP:IP: - Option 148 (unknown - 4 bytes) 0000
ICMP:IP:
IP:


[root@collie ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Ron Albright wrote:

> On Tue, 08 Feb 2005 19:19:57 -0500, Allen McIntosh wrote:
>
> > A subsequent post of yours says you were using tracert. Traceroute uses
> > UDP; I believe tracert uses ICMP. This may be a significant difference.
>
> tracert on Windows traceroute on Linux and Solaris. I wasn't aware there
> was a difference. I always thought tracert was just a Windows port of
> traceroute. Good to know.
>
> >
> > Anyway, I'd suggest starting up your favorite packet sniffer on the
> > output interface of the Fedora box. Then telnet to port 80 on something
> > like google.com from a Linux or Solaris box. When (if) that works, try
> > the same trick from a Windows box. See if you see any traffic. See if
> > it's different. If that doesn't work, pick another port (e.g. ftp) that
> > should be open and try that.
>
> I did some snoops which I included below (the names have been change to
> protect the innocent... err... I mean my network). It doesn't make much
> sense.

Where are packets 4 and 5 ?

Andy.

On Fri, 11 Feb 2005 14:34:03 +0000, Andy Furniss wrote:

> Where are packets 4 and 5 ?
>
> Andy.
I think you mean 3 & 4.

3 is the mystery packet.

IP: Source address = 10.33.50.8, linksysw1.domainname.com
is a wireless access point router that is being used as a hub. The radio
is turned off and nothing is connected to the wan port. I'm not sure why
it decided to toss it's 2 cents in but it looks like it is sending a ICMP
no route to destination in reply to the Windows boxes attempt to contact
239.255.255.250.

<Packet 1>
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 2 arrived at 11:41:23.21
ETHER: Packet size = 62 bytes
ETHER: Destination = 1:1:1:1:1:1,
ETHER: Source = 1:1:1:1:1:2,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 48 bytes
IP: Identification = 44579
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 127 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 138c
IP: Source address = 10.33.51.148, doberman.domainname.com
IP: Destination address = 64.233.187.104, 64.233.187.104
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 2059
TCP: Destination port = 80 (HTTP)
TCP: Sequence number = 1997144279
TCP: Acknowledgement number = 0
TCP: Data offset = 28 bytes
TCP: Flags = 0x02
TCP: ..0. .... = No urgent pointer
TCP: ...0 .... = No acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 65535
TCP: Checksum = 0xc992
TCP: Urgent pointer = 0
TCP: Options: (8 bytes)
TCP: - Maximum segment size = 1260 bytes
TCP: - No operation
TCP: - No operation
TCP: - SACK permitted option
TCP:
HTTP: ----- HTTP: -----
HTTP:
HTTP: ""
HTTP:

<Packet 2>
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 3 arrived at 11:41:23.31
ETHER: Packet size = 60 bytes
ETHER: Destination = 1:1:1:1:1:3,
ETHER: Source = 1:1:1:1:1:1,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 44 bytes
IP: Identification = 30370
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 239 seconds/hops
IP: Protocol = 6 (TCP)
IP: Header checksum = 1b11
IP: Source address = 64.233.187.104, 64.233.187.104
IP: Destination address = 10.33.51.148, doberman.domainname.com
IP: No options
IP:
TCP: ----- TCP Header -----
TCP:
TCP: Source port = 80
TCP: Destination port = 2059
TCP: Sequence number = 1710960700
TCP: Acknowledgement number = 1997144280
TCP: Data offset = 24 bytes
TCP: Flags = 0x12
TCP: ..0. .... = No urgent pointer
TCP: ...1 .... = Acknowledgement
TCP: .... 0... = No push
TCP: .... .0.. = No reset
TCP: .... ..1. = Syn
TCP: .... ...0 = No Fin
TCP: Window = 8190
TCP: Checksum = 0x2853
TCP: Urgent pointer = 0
TCP: Options: (4 bytes)
TCP: - Maximum segment size = 1260 bytes
TCP:
HTTP: ----- HTTP: -----
HTTP:
HTTP: ""
HTTP:

<Packet 3>
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 6 arrived at 11:42:14.31
ETHER: Packet size = 60 bytes
ETHER: Destination = 1:1:1:1:1:4, (multicast)
ETHER: Source = 1:1:1:1:1:3,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 24 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 32 bytes
IP: Identification = 44904
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 1 seconds/hops
IP: Protocol = 2 (IGMP)
IP: Header checksum = 47ae
IP: Source address = 10.33.51.148, doberman.domainname.com
IP: Destination address = 239.255.255.250, 239.255.255.250
IP: Options: (4 bytes)
IP: - Option 148 (unknown - 4 bytes) 0000
IP:

<Packet 4>
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 7 arrived at 11:42:14.31
ETHER: Packet size = 74 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 1:1:1:1:1:6,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 60 bytes
IP: Identification = 44904
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 150 seconds/hops
IP: Protocol = 1 (ICMP)
IP: Header checksum = fb56
IP: Source address = 10.33.50.8, linksysw1.domainname.com
IP: Destination address = 10.33.51.148, doberman.domainname.com
IP: No options
IP:
ICMP: ----- ICMP Header -----
ICMP:
ICMP: Type = 3 (Destination unreachable)
ICMP: Code = 2 (Bad protocol 2)
ICMP: Checksum = a6d8
ICMP:
ICMP: [ subject header follows ]
ICMP:
ICMP:IP: ----- IP Header -----
ICMP:IP:
ICMP:IP: Version = 4
ICMP:IP: Header length = 24 bytes
ICMP:IP: Type of service = 0x00
ICMP:IP: xxx. .... = 0 (precedence)
ICMP:IP: ...0 .... = normal delay
ICMP:IP: .... 0... = normal throughput
ICMP:IP: .... .0.. = normal reliability
ICMP:IP: Total length = 32 bytes
ICMP:IP: Identification = 44904
ICMP:IP: Flags = 0x0
ICMP:IP: .0.. .... = may fragment
ICMP:IP: ..0. .... = last fragment
ICMP:IP: Fragment offset = 0 bytes
ICMP:IP: Time to live = 1 seconds/hops
ICMP:IP: Protocol = 2 (IGMP)
ICMP:IP: Header checksum = 47ae
ICMP:IP: Source address = 10.33.51.148, doberman.domainname.com
ICMP:IP: Destination address = 239.255.255.250, 239.255.255.250
ICMP:IP: Options: (4 bytes)
ICMP:IP: - Option 148 (unknown - 4 bytes) 0000
ICMP:IP:
IP: