head scratcher or am I missing something obvious

Cathy · 2010-10-30, 09:14 PM

Hi all,

Sorry I have been lurking and not posting for awhile.

Ok so I need some input into a member who is having access/connection problems. I will try to give you all as much info as he has given me to explain what is happenig.

This is what he is experiencing:
I was surfing the site, downloading some video fine and then all of a sudden the speeds drop to zero and the site is unresponsive throwing up a connect connect error in opera and firefox. I closed down the browser and tried to go onto the site but once again the front page will not open and i cannot connect to put in my password.
Had problems in the past with slow downloading from certain sites because of packet loss but I have never not been able to access a site at all.

He has contacted his ISP(virgin) who tell him they have not/do not put up a block. If he pings and tracert the site its fine. He says 10 mins all works fine then it starts to go bad.

I have suggested he not use a download manager, just the old fashioned 'right click' .. 'save as' he says he is doing that. Said to do the whole clear cache/cookies and only use 1 browser. Had his IP cleard/unblocked etc etc etc etc but his ip has been checked and there are no flags at our firewall.

OH and he has been a member in the past with NO issues at all .. so what has changed his end ?? He says nothing all is the same.

His setup is as follows:
Vista home premium
2Gb memory
fibre optic 20mb

Sorry about the long winded explanation, I hope it all helps and I hope one of you can send some suggestions my way or have heard of this before.

Thanks in advance for reading and any help.

Cathy xxx

cd34 · 2010-10-31, 01:22 AM

My first guess is that your hosting company has instituted something like mod_throttle which blocks a connection when more than x simultaneous connections are attempted and that number seems low.

The way downloaders work is that they open 6-20 connections at the same time and fetch things in parallel. This typically puts some strain on the webserver depending on what is being requested. As a method of combating this, many hosting companies use a firewall or apache module that blocks the offending IP for a period of time.

Firefox can be configured to use pipelining which is set to 8 or 12 simultaneous connections at the same time. By default, pipelining is off, but, many of the 'faster web' plugins will enable it.

You might check with your hosting company to see if they have recently added connection throttling like that. It is also possible that his ISP instituted similar caps, but, that would be much less likely.

Cathy · 2010-10-31, 04:55 PM

Hey cd34 ..

that possibly could be it, he has used IE/Firefox/Opera as his browsers, so maybe thats it. Of course a different IP addy sets off our server security .. thanks for the suggestions. I will pass them along.

Cathy xxx
p.s. we did/have banned dl managers.

Cathy · 2010-11-01, 01:55 AM

Quote:

Originally Posted by cd34

My first guess is that your hosting company has instituted something like mod_throttle which blocks a connection when more than x simultaneous connections are attempted and that number seems low.

The way downloaders work is that they open 6-20 connections at the same time and fetch things in parallel. This typically puts some strain on the webserver depending on what is being requested. As a method of combating this, many hosting companies use a firewall or apache module that blocks the offending IP for a period of time.

Firefox can be configured to use pipelining which is set to 8 or 12 simultaneous connections at the same time. By default, pipelining is off, but, many of the 'faster web' plugins will enable it.

You might check with your hosting company to see if they have recently added connection throttling like that. It is also possible that his ISP instituted similar caps, but, that would be much less likely.

He is saying he gets this: The error message I get is that I cannot cannot connect to the website. In opera its a blank page and then error, In IE it is page cannot be displayed and in FF it
is the same as opera. It wont connect to your homepage for some reason and yet every other website I visit is ok and I can download from them fine, I am at this
moment downloading from another site fine.

So it is my site that simply doesn't like him !!!

cd34 · 2010-11-01, 02:06 AM

It still sounds like your hosting company is writing a firewall rule to drop his traffic when it exceeds some connection limit. When the rule is triggered there are several different things they can do. Redirect to another site saying bandwidth exceeded, refuse connections, or, drop the traffic altogether for a period of time.

Some of the firewall rules we use (not for web), look at the number of connections within a minute. If that is exceeded, traffic from that IP is dropped until 60 seconds of inactivity from that IP. If they continue hitting every 30 seconds, it refreshes that timer. That sounds pretty similar to what you're describing.

Cathy · 2010-11-01, 07:52 AM

Quote:

Originally Posted by cd34

It still sounds like your hosting company is writing a firewall rule to drop his traffic when it exceeds some connection limit. When the rule is triggered there are several different things they can do. Redirect to another site saying bandwidth exceeded, refuse connections, or, drop the traffic altogether for a period of time.

Some of the firewall rules we use (not for web), look at the number of connections within a minute. If that is exceeded, traffic from that IP is dropped until 60 seconds of inactivity from that IP. If they continue hitting every 30 seconds, it refreshes that timer. That sounds pretty similar to what you're describing.

Ok I will pose that question.

Also we have just installed Phantom Frog .. but .. he was having this issue beforehand !!!!!

A solution would be great .. even if i was told there is no solution !!!!

raymor · 2010-11-01, 10:13 AM

That does sound like a firewall issue, or just net connection problems on his end.
You'd have to check the firewall at the same time that he's having problems.
Also he didn't say whether he checked other sites at the same time, preferably
using shift-refresh to make sure his connection isn't just flaky.

You probably need a qualified sysadmin to take a phone call from him when he's
having the trouble and check the firewall, etc.

flowersgone · 2010-11-01, 10:45 AM

Seems almost too obvious to mention but it hasn't come up yet ...

The web server logs may be useful in tracking this down. Access logs should tell you whether the user is getting through. That may help distinguish a firewall block from a flaky connection. It might also help you tell how many connections are being opened - a bit less sure there. There might also be some kind of error in the error logs - worth a look I guess.

fg

Nymph · 2010-11-01, 12:13 PM

This may sound silly, but find out from your hosting company when the last time your server had a reboot.

I was having a similar issue not too long ago, where I couldn't even connect to my own sites. Seems it had been way too long since the last reboot. After they forced a manual reboot, I'm fly fine now.

Cathy · 2010-11-01, 04:48 PM

Quote:

Originally Posted by Nymph

This may sound silly, but find out from your hosting company when the last time your server had a reboot.

I was having a similar issue not too long ago, where I couldn't even connect to my own sites. Seems it had been way too long since the last reboot. After they forced a manual reboot, I'm fly fine now.

Hi Nymph,

Just had a harddrive upgrade.

Cathy xxx

raymor · 2010-11-01, 05:11 PM

Quote:

Originally Posted by Nymph

This may sound silly, but find out from your hosting company when the last time your server had a reboot.

I was having a similar issue not too long ago, where I couldn't even connect to my own sites. Seems it had been way too long since the last reboot. After they forced a manual reboot, I'm fly fine now.

Note, though, that if a reboot makes a problem go away, all you know is that
it will eventually come back, and now that the problem is temporarily gone,
it's virtually impossible to diagnose.

Personally, I'd much rather diagnose and fix a problem than wait until a user
bothers to email me about it and then reboot and hope it takes a while before
it happens again.

Servers, running network operating systems, should never need a reboot,
except when certain hardware has to be removed. We've had web servers
running years without a reboot. Hard drives and even PCI cards can
be changed out while the system runs.

Cathy · 2010-11-01, 05:16 PM

am now working with my hosting tech to see what we work out.

Cathy · 2010-11-02, 05:50 PM

well .. the short version is it was a firewall issue.

He was simply slamming the server with many multiple connections and getting blocked (even though many many emails ago I said that will get him blocked).

I seriously thought I was missing something huge, for him to be having this issue. Realising it is (or can be) something very simple is a lesson learned.

Thanks all for your input it is much appreciated.

2010-10-30, 09:14 PM	#1
Cathy Rock stars ... is there anything they don't know? Join Date: Apr 2008 Posts: 10	head scratcher or am I missing something obvious Hi all, Sorry I have been lurking and not posting for awhile. Ok so I need some input into a member who is having access/connection problems. I will try to give you all as much info as he has given me to explain what is happenig. This is what he is experiencing: I was surfing the site, downloading some video fine and then all of a sudden the speeds drop to zero and the site is unresponsive throwing up a connect connect error in opera and firefox. I closed down the browser and tried to go onto the site but once again the front page will not open and i cannot connect to put in my password. Had problems in the past with slow downloading from certain sites because of packet loss but I have never not been able to access a site at all. He has contacted his ISP(virgin) who tell him they have not/do not put up a block. If he pings and tracert the site its fine. He says 10 mins all works fine then it starts to go bad. I have suggested he not use a download manager, just the old fashioned 'right click' .. 'save as' he says he is doing that. Said to do the whole clear cache/cookies and only use 1 browser. Had his IP cleard/unblocked etc etc etc etc but his ip has been checked and there are no flags at our firewall. OH and he has been a member in the past with NO issues at all .. so what has changed his end ?? He says nothing all is the same. His setup is as follows: Vista home premium 2Gb memory fibre optic 20mb Sorry about the long winded explanation, I hope it all helps and I hope one of you can send some suggestions my way or have heard of this before. Thanks in advance for reading and any help. Cathy xxx __________________ http://www.cathyscraving.com http://www.cathycash.com

2010-10-31, 01:22 AM	#2
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	My first guess is that your hosting company has instituted something like mod_throttle which blocks a connection when more than x simultaneous connections are attempted and that number seems low. The way downloaders work is that they open 6-20 connections at the same time and fetch things in parallel. This typically puts some strain on the webserver depending on what is being requested. As a method of combating this, many hosting companies use a firewall or apache module that blocks the offending IP for a period of time. Firefox can be configured to use pipelining which is set to 8 or 12 simultaneous connections at the same time. By default, pipelining is off, but, many of the 'faster web' plugins will enable it. You might check with your hosting company to see if they have recently added connection throttling like that. It is also possible that his ISP instituted similar caps, but, that would be much less likely. __________________ SnapReplay.com a different way to share photos - iPhone & Android

2010-10-31, 04:55 PM	#3
Cathy Rock stars ... is there anything they don't know? Join Date: Apr 2008 Posts: 10	Hey cd34 .. that possibly could be it, he has used IE/Firefox/Opera as his browsers, so maybe thats it. Of course a different IP addy sets off our server security .. thanks for the suggestions. I will pass them along. Cathy xxx p.s. we did/have banned dl managers. __________________ http://www.cathyscraving.com http://www.cathycash.com

2010-11-01, 02:06 AM	#5
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	It still sounds like your hosting company is writing a firewall rule to drop his traffic when it exceeds some connection limit. When the rule is triggered there are several different things they can do. Redirect to another site saying bandwidth exceeded, refuse connections, or, drop the traffic altogether for a period of time. Some of the firewall rules we use (not for web), look at the number of connections within a minute. If that is exceeded, traffic from that IP is dropped until 60 seconds of inactivity from that IP. If they continue hitting every 30 seconds, it refreshes that timer. That sounds pretty similar to what you're describing. __________________ SnapReplay.com a different way to share photos - iPhone & Android

2010-11-01, 10:13 AM	#7
raymor The only guys who wear Hawaiian shirts are gay guys and big fat party animals Join Date: Jan 2004 Posts: 178	That does sound like a firewall issue, or just net connection problems on his end. You'd have to check the firewall at the same time that he's having problems. Also he didn't say whether he checked other sites at the same time, preferably using shift-refresh to make sure his connection isn't just flaky. You probably need a qualified sysadmin to take a phone call from him when he's having the trouble and check the firewall, etc. __________________ Ray Morris support@bettercgi.com Strongbox/Throttlebox & more TXDPS #A14012

2010-11-01, 10:45 AM	#8
flowersgone Are you sure you're an accredited and honored pornographer? Join Date: Sep 2008 Posts: 67	Seems almost too obvious to mention but it hasn't come up yet ... The web server logs may be useful in tracking this down. Access logs should tell you whether the user is getting through. That may help distinguish a firewall block from a flaky connection. It might also help you tell how many connections are being opened - a bit less sure there. There might also be some kind of error in the error logs - worth a look I guess. fg __________________ Thank you for checking out my: Portfolio and Tech Services

2010-11-01, 12:13 PM	#9
Nymph Get me! Join Date: Jan 2009 Location: Lower Alabama-The Redneck Riviera Posts: 677	This may sound silly, but find out from your hosting company when the last time your server had a reboot. I was having a similar issue not too long ago, where I couldn't even connect to my own sites. Seems it had been way too long since the last reboot. After they forced a manual reboot, I'm fly fine now.

2010-11-01, 05:16 PM	#12
Cathy Rock stars ... is there anything they don't know? Join Date: Apr 2008 Posts: 10	am now working with my hosting tech to see what we work out. __________________ http://www.cathyscraving.com http://www.cathycash.com

2010-11-02, 05:50 PM	#13
Cathy Rock stars ... is there anything they don't know? Join Date: Apr 2008 Posts: 10	well .. the short version is it was a firewall issue. He was simply slamming the server with many multiple connections and getting blocked (even though many many emails ago I said that will get him blocked). I seriously thought I was missing something huge, for him to be having this issue. Realising it is (or can be) something very simple is a lesson learned. Thanks all for your input it is much appreciated. __________________ http://www.cathyscraving.com http://www.cathycash.com