No internet connectivity when phorm.com is blocked (split from monster phorm thread)

[The Jackal]

Originally Posted by Heed

Yes, I can reach that when I have phorm.com blocked.

Which going back to what I've been saying before - your DNS is barfed I would seriously like to know how you are blocking phorm.

Can I add a final note ?

I don't know how you're blocking those IP ranges but it's not going to help. If I were to design the phorm infrastructure I would have to build my application servers and message queuing system within Virgin's infrastructure.

Pushing each request out especially if they are managed by some small outfit like fasthosts is going to overload their network and imply latency to the end user. Hmmm come to think about Virgin doesn't give a toss about the end user experience so they might adopt this model anyway

But ideally message pooling within Virgin's network is going to be the best way to implement phorm and if that's the case there's going to be no escaping phorm

[Heed]

Originally Posted by The Jackal

Which going back to what I've been saying before - your DNS is barfed I would seriously like to know how you are blocking phorm.

Can I add a final note ?

I don't know how you're blocking those IP ranges but it's not going to help. If I were to design the phorm infrastructure I would have to build my application servers and message queuing system within Virgin's infrastructure.

Pushing each request out especially if they are managed by some small outfit like fasthosts is going to overload their network and imply latency to the end user. Hmmm come to think about Virgin doesn't give a toss about the end user experience so they might adopt this model anyway

But ideally message pooling within Virgin's network is going to be the best way to implement phorm and if that's the case there's going to be no escaping phorm

I'm simply blocking phorm.com via my firewall -- Comodo. Yes, DNS seems to be the culprit, but the question is why does it fail only when I have phorm.com blocked? It's unlikely to be the firewall itself as I've tried blocking other domains like bbc.co.uk or google.com and things function fine except when trying to reach the blocked domain -- as it should be. But switch google.com to phorm.com and DNS gets borked.

Also, please forget about the IP ranges. Since this morning the only thing I have blocked is the domain name phorm.com -- that's where I'm seeing the problem.

As for helping to keep phorm at bay or not, I don't know -- but it just seems like a prudent thing to do -- certainly not something that should have a negative impact unless trying to visit phorm.com.

[Deko]

Guys maybe a trace using wireshark might show us something.


Do a trace zip it and PM it to me , Do 2 tests with blocking and without blocking phorm.com


Make sure you shut down other internet apps to reduce the amount of data captured.

http://www.wireshark.org/

[Heed]

Originally Posted by Deko

Guys maybe a trace using wireshark might show us something.


Do a trace zip it and PM it to me , Do 2 tests with blocking and without blocking phorm.com


Make sure you shut down other internet apps to reduce the amount of data captured.

http://www.wireshark.org/

Can you attach files to a PM? I couldn't see a way, so here's a link to the file:

http://homepage.ntlworld.com/kbyiers/PhormCapture.rar

[Rchivist]

Originally Posted by Heed

Yes, I can reach that when I have phorm.com blocked.

Actually, I can reach it in Opera but not IE or FF2. I'm going to do a machine reboot and double check.

Hmm, after a machine reboot I can still get there in Opera, but not IE and FF2. This might be somehow related to the behaviour I noted earlier where if I visited a site successfully I could then get back most of the time after phorm.com was blocked.

EDIT: Finally loaded in FF2 without any images except the banner title (showing a lookup pending for newsimg.bbc.co.uk). Have got the banner title but no more to show up in IE.

I did have a single episode of the BBC news site loading without ANY images a couple of days ago - at that time I think I had a variety of BTwebwise sites blocked, and if I recall correctly that was the day the BTWebwise site was down. Hasn't happened since and I have NO blocks in place at present - deliberately.

I tried blocking www.phorm.com via comodo and no connection was possible including email etc, it just shut the connection completely, removed block on phorm and all retuned to normal.
Then blocked other sites via comodo and no connection problems at all.
Weird.

[Heed]

Originally Posted by tony

I tried blocking www.phorm.com via comodo and no connection was possible including email etc, it just shut the connection completely, removed block on phorm and all retuned to normal.
Then blocked other sites via comodo and no connection problems at all.
Weird.

Thank you!

I was beginning to feel like I was fighting a one man up-hill battle to show that this isn't some run of the mill connection issue.

A confirmation of the issue just as described is exactly what I needed.

And yes, weird, indeed.

I have phorm.com and webwise.net in hosts file but this doesn't cause any problems, someone posted that they have phorm.com blocked in router and have no problems, is it possible that comodo is the problem, although it only has a problem with phorm.com.

[Bonglet]

It could be comodo but why would comodo deney access to everything just when you put phorm.com in and not when you put anything else in?.

im installing it and going to test it out for myself now .

[Heed]

Originally Posted by tony

I have phorm.com and webwise.net in hosts file but this doesn't cause any problems, someone posted that they have phorm.com blocked in router and have no problems, is it possible that comodo is the problem, although it only has a problem with phorm.com.

Yeah, it's a possibility. It seems odd it would only display this buggy behaviour with one domain, but bugs can be tricky. It's also not clear if it's just certain geographical areas that are affected or not.

I know some people have said they have phorm.com blocked and have no problems, but it might be area dependant. Also, it only seems to happen if you're using the default NTL DNS servers. The issue disappears with phorm.com blocked via Comodo if I switch to another DNS server. So, if some of those not seeing a problem are using non NTL DNS servers that would make sense.

I don't know if it is relevant to the discussion here, but a response from BT management quoted on the BT forum states that if a user adds www.webwise.net to their hosts file with a resolved address of 127.0.0.1, whilst opted in to Phorm during the forthcoming BT trials, they will lose all internet access. Would adding to the hosts file have the same effect as blocking? If so, this does begin to smell like a secret trial, perhaps on a small number of ubrs?

http://www.beta.bt.com/bta/forums/th...rt=0&start=135

I,ve posted on comodo forums about this, will see if any answers are forthcoming, a bit sceptical re comodo forums due to the excessive fanboy attacks from previous questions placed.

---------- Post added at 20:00 ---------- Previous post was at 19:58 ----------

Originally Posted by Heed

Yeah, it's a possibility. It seems odd it would only display this buggy behaviour with one domain, but bugs can be tricky. It's also not clear if it's just certain areas that are affected or not.

I know some people have said they have phorm.com blocked and have no problems, but it might be area dependant. Also, it only seems to happen if you're using the default NTL DNS servers. The issue disappears with phorm.com blocked via Comodo if I switch to another DNS server. So, if some of those not seeing a problem are using non NTL DNS servers that would make sense.

I have opendns setup in router, so don't use ntl dns.

[Heed]

I just read that from your post in the monster phorm thread, John.

The thing is, he only mentions traffic on port 80. So far, if it happens all ports seem to be affected, so that doesn't seem to be the same thing unless he's mistaken.

Tony, good idea. I've never been to their forums, so I hope you get an intelligent response.

Originally Posted by JohnHorb

I don't know if it is relevant to the discussion here, but a response from BT management quoted on the BT forum states that if a user adds www.webwise.net to their hosts file with a resolved address of 127.0.0.1, whilst opted in to Phorm during the forthcoming BT trials, they will lose all internet access. Would adding to the hosts file have the same effect as blocking? If so, this does begin to smell like a secret trial, perhaps on a small number of ubrs?

http://www.beta.bt.com/bta/forums/th...rt=0&start=135

I have webwise in hosts file but this causes no problems, also have phorm.com in there with no problems, can put webwise.net into blocked address in comodo and have no problems, but once i put phorm.com in all connection goes.

[kt88man]

When I tested this earlier today it was using NTL's DNS servers (194.168.4.100 194.168.8.100) and I was unable to duplicate the problem when blocking phorm.com in hosts, or at router.

Does the same thing happen if you block webwise.net?