No internet connectivity when phorm.com is blocked (split from monster phorm thread) - Page 3

Graham M · 18-04-2008, 15:38

I'm confused, who is The Jackal?!

The Jackal · 18-04-2008, 15:41

Quote:

Originally Posted by Heed

I would be more than happy to put it down to something innocent like poor NTL DNS servers, but I can't escape the fact that several dozen times I have switched from blocking/unblocking phorm.com and each time it resulted in no connectivity (block) and connectivity (unblocked) when using the default NTL DNS servers. That can't be a coincidence, can it?

Well it seems like your connection is failing to do a name resolution this is hardly blocked internet access.

If you can when you say your internet is blocked can you do a

netstat -n so that we can see exactly where your machine is trying to connect to.

Repeat when connected.

Heed · 18-04-2008, 15:46

Quote:

Originally Posted by The Jackal

Well it seems like your connection is failing to do a name resolution this is hardly blocked internet access.

If you can when you say your internet is blocked can you do a

netstat -n so that we can see exactly where your machine is trying to connect to.

Repeat when connected.

Well, when you can't resolve a domain name that's a lot of the internet unavailable. But let's not quibble about that.

C:\Documents and Settings\Heed>netstat -n

Active Connections

Proto Local Address Foreign Address State
TCP 82.11.31.190:4503 208.69.34.230:80 ESTABLISHED

C:\Documents and Settings\Heed>netstat -n

Active Connections

Proto Local Address Foreign Address State
TCP 82.11.31.190:4503 208.69.34.230:80 ESTABLISHED

No difference with phorm.com blocked or unblocked.

I'm back on the default DNS servers for testing purposes.

And as soon as phorm.com is blocked I can't resolve domain names and as soon as it's ublocked I can.

The Jackal · 18-04-2008, 15:51

Quote:

Originally Posted by Heed

And as soon as phorm.com is blocked I can't resolve domain names and as soon as it's ublocked I can.

Try to trace what is happening to your DNS resolutions. (tcp/udp ports 53)

I don't know much about windows so maybe someone else can help get the tools that you need to monitor tcp connections.

I used to use a tcp/ip monitor but for the love of life can't remember what it was called.

Good luck - Let us know where it fails as I'd love to play with this further.

Thankyou

Cobbydaler · 18-04-2008, 15:55

Quote:

Originally Posted by The Jackal

Try to trace what is happening to your DNS resolutions. (tcp/udp ports 53)

I don't know much about windows so maybe someone else can help get the tools that you need to monitor tcp connections.

I used to use a tcp/ip monitor but for the love of life can't remember what it was called.

Good luck - Let us know where it fails as I'd love to play with this further.

Thankyou

tcpmon?

Heed · 18-04-2008, 15:57

Quote:

Originally Posted by The Jackal

Try to trace what is happening to your DNS resolutions. (tcp/udp ports 53)

I don't know much about windows so maybe someone else can help get the tools that you need to monitor tcp connections.

I used to use a tcp/ip monitor but for the love of life can't remember what it was called.

Good luck - Let us know where it fails as I'd love to play with this further.

Thankyou

Yeah, we've reached the extent of my networking and networking tools knowledge.

I've done another tracert and I'm still showing a fail (time out) on my third hop to midd-t3core-1b-ge-010-0.inet.ntl.com when phorm.com is blocked.

The Jackal · 18-04-2008, 15:57

Quote:

Originally Posted by Cobbydaler

tcpmon?

I love this guy. Spot on everytime.

Yeh that's the one I used.

Heed · 18-04-2008, 16:02

Okay, running tcpmon now. With phorm.com blocked it shows nothing when I try to hit a site -- no connections nothing in the log.

The Jackal · 18-04-2008, 16:29

And what do you see in the logs when you ping the bbc as follows

ping 212.58.226.20

---------- Post added at 16:29 ---------- Previous post was at 16:27 ----------

oops tcpmon doesn't monitor pings.

instead try

telnet 212.58.226.20 80

You should see the ack sent and possibly an established state

Heed · 18-04-2008, 16:44

The Jackal · 18-04-2008, 16:50

Quote:

Originally Posted by Heed

So you're connected but you can't see it in a browser. What about opera , IE , firefox, erm lynx for windows even

Within the terminal

telnet 212.58.226.20 80

hit ctrl-c several times

hit the return key and you should see the HTML from the bbc site.

And when you're blocked you can't do nslookups ?

---------- Post added at 16:50 ---------- Previous post was at 16:48 ----------

ps what happens when you put this in your browser ?

http://212.58.226.20/

Heed · 18-04-2008, 16:51

If I hit ctrl+c or enter I just get "Bad request" and "connection to host lost".

The Jackal · 18-04-2008, 16:53

Quote:

Originally Posted by Heed

If I hit ctrl+c or enter I just get "Bad request" and "connection to host lost".

Thats excellent and in the browser (opera/IE/firefox) ?

http://212.58.226.20/

Rchivist · 18-04-2008, 16:56

Quote:

Originally Posted by Gavin

Tracing those 3 IPs, I can't see a link to Phorm.

88.208.250.66 > live-servers.net > Fasthosts
88.208.250.85 > live-servers.net > Fasthosts
207.44.186.90 > ThePlanet

So i'm guessing sites not hosted or routed through those companies should still work?

Fasthosts is where the BT Webwise pages are hosted
www.webwise.bt.com
- they used to be on Phorm related IP's looked after in Houston Texas by GODADDY, but now they are with the cheap budget hosting site Fasthosts. When Fasthosts went down earlier this week BT Webwise pages went down too.

Heed · 18-04-2008, 17:04

Quote:

Originally Posted by The Jackal

Thats excellent and in the browser (opera/IE/firefox) ?

http://212.58.226.20/

Yes, I can reach that when I have phorm.com blocked.

Actually, I can reach it in Opera but not IE or FF2. I'm going to do a machine reboot and double check.

Hmm, after a machine reboot I can still get there in Opera, but not IE and FF2. This might be somehow related to the behaviour I noted earlier where if I visited a site successfully I could then get back most of the time after phorm.com was blocked.

EDIT: Finally loaded in FF2 without any images except the banner title (showing a lookup pending for newsimg.bbc.co.uk). Have got the banner title but no more to show up in IE.