Can Only Connect to Forum with Cellular?

[Forum Boss]

ditch sucuri and use cloudflare

the problem can only be between the end user and Sucuri

Actually it is quite a bit more complicated than that, and not necessarily solved at all by getting a new Firewall company. Not at all. Keep in mind that Sucuri has been running fine for YEARS for us.

 

[ronsatspokane]

So I'm back and working on all fronts. The nslookup looks good, the ping works, the tracert works and I can access the site via my browser. What the people the forum boss is working with are probably going to want is a packet level trace. If you have troubles getting to the site (a timeout) and you have wireshark installed, grab a packet level trace filtered on the host forum.accurateshooter.com and send it to the forum boss. I'll be watching and grab one as well if it fails for me.

 

[GeoffR]

https://www.news.com.au/technology/...n/news-story/d41781f7a61fc89283d143ed75add63f

I wonder if this has anything to do with us?

 

[GeoffR]

Agreed. There is a limit to what can be determined from the outside looking in, as we are. I think we have hit that limit.

 

[Bill Norris]

Want to personally thank the Boss for all the extra efforts to corral this issue.

 

[Leo Smith]

Read this Today.
UNDER ATTACK
Facebook, Instagram, Fortnite, T-Mobile and Comcast users ‘hit by massive cyber attack sparking outages across the US’

• Erica Davies

• Jun 15 2020, 20:33 ET
• Updated: Jun 16 2020, 4:35 ET

 

[rjtfroggy]

When I posted this problem last week the post was removed and I was told the problem was on my end.
Well after reading 6 pages about this I guess I was not the only one affected.

 

[carlsbad]

Acting up again this morning. At 0600 pdt I was commenting on a thread and them I couldn't connect. Now I'm on the thumbtyper again.

 

[Forum Boss]

All I can say is I have spent many HOURs trying to diagnose, understand, and remedy the situation. Everything is indicating the problem is Downstream of our Firewall and downstream of our host.

But WHY this affects our site and not others I don't know. Something is causing signals not to move efficiently between user computers to Sucuri, our Firewall.

 

[ronsatspokane]

I'm failing again this morning as well. Posted both a failing tracert and an nslookup to the conversation. Send that to them. Cellphone working.

 

[DRNewcomb]

........Facebook, Instagram, Fortnite, T-Mobile and Comcast users ‘hit by massive cyber attack sparking outages across the US’....

Apparently T-Mobile's problem was just an "Oh, S*it" while they were trying to accomplish some network integration task re the Sprint merger.

 

[Bill Norris]

No issues noted with my Wi-Fi connection today so far. Day # 3 with no problems (yet).

 

[Rick300]

Yesterday and today seems good to me. You must of fixed something

 

[INTJ]

I downloaded a free VPN a few minutes ago and it fixed the my Comcast connection issues. Interestingly, after I connected with the VPN I turned it off and restarted my browser. I am online now without VPN. Go figure............

 

[newbieshooter]

I downloaded a free VPN a few minutes ago and it fixed the my Comcast connection issues. Interestingly, after I connected with the VPN I turned it off and restarted my browser. I am online now without VPN. Go figure............

probably a coincidence? My home broadband hasn't been able to load the forum since 2am PT this morning (6/16). I've been toggling VPN to gain access to forums when needed.
Forum started working w/o VPN about 6PM PT.

 

[ronsatspokane]

Access from my computer just started working within the last hour. It has been down all day. Access from my cell phone (which follows a different path) has been working all along. It looks like a routing black hole in gtt.net which is a transit network some people are crossing (depending on their location). An email was sent to them regarding the issue. Not sure if they have done anything about it since the behavior today is the same as it was yesterday. As in, dead during the day, alive in the early evening.

 

[GeoffR]

Since you mention it Ron, I have been dealing with a "black hole" (good descriptor) here in Australia with what is supposed to be our premier network - and also my ISP - for three months now. Traces generally to North America and UK/Europe would simply stop at a certain gateway in this network. Nothing would get past the hole. I have had at least four tickets open with them over the last two months and then it would come good. For maybe a week or two. Then down again.

We just closed the last ticket a couple of days ago after two weeks of up time - that coincided with me replacing my modem. But no-one can explain to me how a dying modem can affect routing in Sydney and Perth (I am in Canberra hundreds of miles away). While not affecting all the scammers/spammers/etc out there!

At the same time I was suffering from these holes, I have been dealing with all this DDOS, web site attacks, and port scan crap. (How come they can get to me but other legit traffic can't???) These attacks do appear to come mainly from points west of me and north of them... So it seemed to me (and still does) that whatever the problem is (or was) has nothing to do with my infrastructure but is somewhere else.

So, a similar problem to what Forum Boss is chasing but not quite. I really do feel for him as it is very frustrating and it is had (at least in my case) to find someone in the ISP who knows much about this stuff.

I now wait for the next occurrence of the black hole... What I have been dealing with is _very_ similar to what is happening to the forum website. But on completely different networks though.

Fishing is looking as an attractive new pass time to consider.

 

[Aeon]

@GeoffR side track but if you don't hide your ip behind a cdn like sucuriti or cloudflare the malicious traffic will never end. They are not just firewalls, they cached content and they let you hide safe and sound with no visible ip to the outside world. Not sure how good they work down in au as my xenforo site is up in north America

 

[GeoffR]

@GeoffR side track but if you don't hide your ip behind a cdn like sucuriti or cloudflare the malicious traffic will never end. They are not just firewalls, they cached content and they let you hide safe and sound with no visible ip to the outside world. Not sure how good they work down in au as my xenforo site is up in north America

Tempting. But I have special software running behind one of my sites that I don't think I could implement on one of these.

To be honest, I don't know much about them. Or what they cost.

But I do know that the status quo is giving me the irrits!

 

[ronsatspokane]

Since you mention it Ron, I have been dealing with a "black hole" (good descriptor) here in Australia with what is supposed to be our premier network - and also my ISP - for three months now. Traces generally to North America and UK/Europe would simply stop at a certain gateway in this network. Nothing would get past the hole. I have had at least four tickets open with them over the last two months and then it would come good. For maybe a week or two. Then down again.

We just closed the last ticket a couple of days ago after two weeks of up time - that coincided with me replacing my modem. But no-one can explain to me how a dying modem can affect routing in Sydney and Perth (I am in Canberra hundreds of miles away). While not affecting all the scammers/spammers/etc out there!

At the same time I was suffering from these holes, I have been dealing with all this DDOS, web site attacks, and port scan crap. (How come they can get to me but other legit traffic can't???) These attacks do appear to come mainly from points west of me and north of them... So it seemed to me (and still does) that whatever the problem is (or was) has nothing to do with my infrastructure but is somewhere else.

So, a similar problem to what Forum Boss is chasing but not quite. I really do feel for him as it is very frustrating and it is had (at least in my case) to find someone in the ISP who knows much about this stuff.

I now wait for the next occurrence of the black hole... What I have been dealing with is _very_ similar to what is happening to the forum website. But on completely different networks though.

Fishing is looking as an attractive new pass time to consider.

Connections from my computer are working this morning. The transit network in question was gtt.net. They are a global company. In browsing their website I found that they have a remote trigger that results in black holing traffic during DdoS attacks. It is one of their sales points. Since we do not know anything about the algorithm they use or what triggers it, it would be difficult to finger that as the cause. But, based on the behavior and on the trace data it does seem like a possible cause. The tracert showed that traffic was routed between three nodes within gtt.net and then failed to proceed further. Several things could cause that. One would be that ICMP was shutdown on the next hop, another could be that the destination could not be resolved and yet another would be that there was no route beyond that third box (black hole). The first cause would render tracert unreliable as a diagnostic tool. The second would impact all users trying to route traffic to that destination. The third would explain what we were seeing in that when we were able to reach the destination, the third hop in gtt.net was always the same box. When it failed, the third hop looked like some virtual router based on the name of the box. The current guess is that they were tagging traffic to the black hole based on origin subnet. We will see if it happens again. I'll keep checking from my machine.