SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Fri, 11 Jul 2003 16:37:41 PDT7
From:	"Steven Levine" <steve53@earthlink.net >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: iptrace again

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

In <3F0F2F38.2DAA5681@verizon.net>, on 07/11/03
at 02:41 PM, Zdenek Jizba said:

> ppp0:[ 0.000]: process_pkt: len=33, type=24
> ppp0:[ 13.750]: process_pkt: len=53, type=24
> ppp0:[ 16.250]: process_pkt: len=33, type=24
> ppp0:[ 30.016]: process_pkt: len=34, type=24
> ppp0:[ 3.047]: process_pkt: len=83, type=24
> ppp0:[ 0.000]: process_pkt: len=61, type=24

I am surprised you did not send me the entire trace as an attachment, but
that's probably part of your problem.

What's here is enough to get started.

Your computer's IP address for this trace is 068.136.071.034

Here we go at time 0.

>-------------------------- #:1 --------------------------
> Delta Time: 0.000sec Packet Length: 33 bytes (21 hex)
> PPP: Protocol 0x0021 (IP)
> PPP: Dest: 224.000.000.001 Source: 067.193.240.011
>----------------------- IP HEADER -----------------------
> IP: Version: 4 Correct Header Length: 20 bytes
> IP: Type Of Service: 00
> IP: 000. .... Routine
> IP: ...0 .... Normal Delay
> IP: .... 0... Normal Throughput
> IP: .... .0.. Normal Reliability
> IP: Total Len: 28 (x1C) bytes Id: 01CB
> IP: Flags: 0
> IP: .0.. May Fragment
> IP: ..0. Last Fragment
> IP: Fragment Offset: 000
> IP: Time To Live: 01 sec Protocol: 2 IGMP
> IP: Header Checksum: A447 (Correct)
> IP: No Options
>------------------------IGMP Header-------------------
> IGMP: Version: 1
> IGMP: Type: 1 QUERY
> IGMP: Checksum: EE9B (Correct)
> IGMP: Group Adress: 000.000.000.000

I am not that familiar with IGMP. I don't know why you are seeing this
packet. It might be related and it might not.

Fourteen seconds later:

>-------------------------- #:2 --------------------------
> Delta Time: 14.203sec Packet Length: 53 bytes (35 hex)
> PPP: Protocol 0x0021 (IP)
> PPP: Dest: 199.045.049.011 Source: 068.136.071.034
>----------------------- IP HEADER -----------------------
> IP: Version: 4 Correct Header Length: 20 bytes
> IP: Type Of Service: 00
> IP: 000. .... Routine
> IP: ...0 .... Normal Delay
> IP: .... 0... Normal Throughput
> IP: .... .0.. Normal Reliability
> IP: Total Len: 48 (x30) bytes Id: 02FB
> IP: Flags: 2
> IP: .1.. Don't Fragment
> IP: ..0. Last Fragment
> IP: Fragment Offset: 000
> IP: Header Checksum: B3EA (Correct)
> IP: No Options
>---------------------- TCP HEADER ----------------------
> TCP: Source Port: 62786 (Unassigned port) Dest Port: 119
>(Unassigned p
>ort)
> TCP: Sequence #: 2030259957
> TCP: Ack #: 0
> TCP: Offset: 28 bytes
> TCP: Flags: 02
> TCP: ..0. .... Urgent bit Off
> TCP: ...0 .... Ack bit Off
> TCP: .... 0... Push bit Off
> TCP: .... .0.. Reset bit Off
> TCP: .... ..1. Synchronize bit On
> TCP: .... ...0 Finish bit Off
> TCP: Window: 32768 Checksum: C271 (Correct)
> TCP: Option Code: 02 Length: 4 bytes [MSS]
> TCP: Max Segment Size 1484 (x5CC)
> TCP: Option Code: 01 Length: 1 bytes [NOP]
> TCP: No Operation
> TCP: Option Code: 03 Length: 3 bytes [WIN_SCALE]
> TCP: Window scale factor 0 (x0)
> TCP: No data or not output.

This is the first attempt to contact news server:

name: news.verizon.net
IP: 199.045.049.011
Port: 119

There is no response. The IP is correct according to whois and nslookup.
However, I can't get it to respond here when I do the standard test:

telnet -p 119 199.45.049.11

This could be because it is dead or because it is set up ignore
connections from outside the verizon.net domain. Peter uses verizon so he
can test this if helps lurking. You do the same. Just enter the command
on the command line.

Fifteen seconds later:

>-------------------------- #:3 --------------------------
> Delta Time: 15.797sec Packet Length: 33 bytes (21 hex)
> PPP: Protocol 0x0021 (IP)
> PPP: Dest: 224.000.000.001 Source: 067.193.240.011
>----------------------- IP HEADER -----------------------
> IP: Version: 4 Correct Header Length: 20 bytes
> IP: Type Of Service: 00
> IP: 000. .... Routine
> IP: ...0 .... Normal Delay
> IP: .... 0... Normal Throughput
> IP: .... .0.. Normal Reliability
> IP: Total Len: 28 (x1C) bytes Id: 70CC
> IP: Flags: 0
> IP: .0.. May Fragment
> IP: ..0. Last Fragment
> IP: Fragment Offset: 000
> IP: Time To Live: 01 sec Protocol: 2 IGMP
> IP: Header Checksum: 3546 (Correct)
> IP: No Options
>------------------------IGMP Header-------------------
> IGMP: Version: 1
> IGMP: Type: 1 QUERY
> IGMP: Checksum: EE9B (Correct)
> IGMP: Group Adress: 000.000.000.000

Another mystery packet.

>------------------------IGMP Header-------------------
>------------------------IGMP Header-------------------

Data cut off my end-user. Please e-mail me the entire, unsullied trace
file. If it's big (i.e. over 500KB, zip it up first. Otherwise, don't
bother to zip it.

Also, it would help if you sent along the output of:

ifconfig ppp0

This helps me know which IPs apply to which systems.

To summarize, there are two possible reasons for the failure:

- the news server is dead
- the news server does not believe you have the right to connect to it

More will be revealed with additional analysis.

You need to run the same trace when connected to a working news server.

Steven

--
----------------------------------------------------------------------
"Steven Levine" MR2/ICE 2.37 #10183 Warp4/FP15/14.093c_W4
www.scoug.com irc.webbnet.info irc.fyrelizard.org #scoug (Wed 7pm PST)
----------------------------------------------------------------------

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 11 | July | 2003 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.