thehelper.net server unreachable from (parts of ?) Europe

[enouwee]

For the last 10-12 hours, this server isn't reachable anymore for me and other people could be affected as well. Using an intermediate bounce isn't exactly the best/safest/fastest way to access the forum

It looks like an intermediate hop in the EV1/ThePlanet AS is filtering packets or null-routing them:

traceroute to 64.246.58.35, 30 hops max, 38 byte packets
[...]
 6  ge-7-1-0-253.fra10.ip.tiscali.net (213.200.64.57)  239.119 ms  221.309 ms  272.726 ms
 7  so-2-0-0.was10.ip.tiscali.net (213.200.82.197)  407.582 ms  373.409 ms  359.866 ms
 8  64.128.212.33 (64.128.212.33)  481.405 ms  297.161 ms  314.363 ms
 9  core-01-ge-0-3-0-1.asbn.twtelecom.net (64.129.249.9)  386.267 ms  437.278 ms  421.808 ms
10  dist-02-so-1-0-0-0.hsto.twtelecom.net (66.192.242.19)  500.626 ms  342.015 ms  361.606 ms
11  hagg-02-ge-1-3-0-503.hsto.twtelecom.net (66.192.246.121)  376.238 ms  484.475 ms  487.305 ms
12  216-54-253-2.ev1.net.demarc (216.54.253.2)  511.446 ms  471.141 ms  516.149 ms
13  * * *

Traces done from public webforms are working fine, but follow another path (above.net AS, rather than twtelecom.net). Maybe someone could notify or ask EV1 why such drastic measures have been configured (DDoS counter-measures? Some tensions between tier-one providers?).

 

[Miz]

Well some people on AIM have been complaining that in Europe Thehelper isn't working so it can't be just you

 

[The Helper]

We have been under a massive Denial of Service attack from a European Source so the hosts automatic protection filters went into place. I think it is OK now but I am not in Europe so I am not 100% for sure.

 

[enouwee]

We have been under a massive Denial of Service attack from a European Source so the hosts automatic protection filters went into place. I think it is OK now but I am not in Europe so I am not 100% for sure.

Still unreacheable as of now, the next hop after 216-54-253-2.ev1.net.demarc still drops the packets.

The Live Supprt helldesk guy I went complaining to yesterday promised that he "will make a note of the issue and pass it to the appropriate authority", which essentially means to me: "Whatever your issue is, better live with it". :banghead:

I'm just hoping that more complaints will help escalating the problem, but basically everything that is sent to EV1/ThePlanet through that Tiscali link ends up in the dropped packets nirvana.

Fighting off a DoS attack by sewering off parts of the interweb is well ... another denial of service. Better wait and see then.

 

[AceHart]

Actually, the DoS by The Planet had and still has way more impact than the couple script kiddiots that played with their latest toys to pass the holiday bore...

There's currently a support ticket open on this.

I'll post it here once they found someone who knows what he's talking about.

The Planet are a bunch of fucking idiots!


Time to leave that crap...

 

[enouwee]

I'll post it here once they found someone who knows what he's talking about.

The Planet are a bunch of fucking idiots!

I can only side with this.

ThePlanet must have one of the lousiest tech supports I've ever had to deal with. Hopefully my email reaches someone, as their helldesk can't even hand out the correct contact information to send the information they requested.

 

[Tonks]

Odd that I'm running through the European area, or something in Alaska is DoS, too. I've been unable to access the site for the past few days.

 

[enouwee]

Odd that I'm running through the European area, or something in Alaska is DoS, too. I've been unable to access the site for the past few days.

The server is accessible again for me, but the packets follow a different route, not through twtelecom.net. Tiscali is able to reach the server too, following the same path.

Hard to tell what happened to the initial route through twtelecom.net and whether everyone's able to access thehelper.net or not:

traceroute to backup.webhosting.it (64.246.58.35), 30 hops max, 38 byte packets
 7  f-eb5.F.DE.net.DTAG.DE (62.154.17.58)  354.826 ms  163.646 ms  198.333 ms
 8  62.156.128.98 (62.156.128.98)  259.843 ms  352.508 ms  385.697 ms
 9  xe-1-1-0.r21.frnkge03.de.bb.gin.ntt.net (129.250.2.12)  327.627 ms  385.134 ms  392.292 ms
10  as-0.r23.amstnl02.nl.bb.gin.ntt.net (129.250.5.22)  236.163 ms  147.592 ms  140.151 ms
11  p64-1-1-0.r20.asbnva01.us.bb.gin.ntt.net (129.250.3.252)  271.420 ms  351.191 ms  403.419 ms
12  ae-0.r21.asbnva01.us.bb.gin.ntt.net (129.250.2.17)  462.470 ms  297.110 ms  326.342 ms
13  p64-3-1-0.r20.dllstx09.us.bb.gin.ntt.net (129.250.5.24)  356.480 ms  486.454 ms  524.081 ms
14  p64-1-0-0.r20.hstntx01.us.bb.gin.ntt.net (129.250.4.71)  359.375 ms  318.138 ms  380.775 ms
15  xe-4-1.r03.hstntx01.us.bb.gin.ntt.net (129.250.2.229)  464.156 ms  518.731 ms  481.087 ms
16  ge-1.ev1.hstntx01.us.bb.gin.ntt.net (129.250.10.70)  302.574 ms  493.016 ms  524.325 ms
17  ivhou-207-218-245-28.ev1servers.net (207.218.245.28)  370.459 ms  321.333 ms  358.296 ms
18  ivhou-207-218-223-116.ev1servers.net (207.218.223.116)  443.910 ms  481.098 ms  527.957 ms
19  backup.webhosting.it (64.246.58.35)  502.567 ms  519.126 ms  442.041 ms

 

[Logical_1]

Per the support ticket from the host:
With this information I was about to reproduce this problem and have discovered that one of our edge routers at dc1 (H1) requires maintenance. I have turned down all inbound traffic across this router.

 

[enouwee]

Per the support ticket from the host:
With this information I was about to reproduce this problem and have discovered that one of our edge routers at dc1 (H1) requires maintenance. I have turned down all inbound traffic across this router.

These guys deserve beating, I've hardly ever seen such incompetence. :nuts:

So a router requires "maintenance" (hint: flush the ACLs?), and they notice it 48 hours and a few live chats later? Worse: one's being promised that the issue will be investigated, but nothing happens. :banghead:

Not that they haven't been given enough indications to pin-point the problem (my description is far from vague):

1st try (Friday 2PM)
I'm trying to reach 64.246.58.35 ( www.thehelper.net ) from AS...., but it looks to me that the packets get dropped after the 1st hop (your IP: 216.54.253.2) on the EV1/ThePlanet network coming from the twtelecom.net AS (their last hop IP: 66.192.246.121). The server itself is fine and reachable by other means, as I can access it by using a bounce host

2nd try, (Saturday 7AM)
as i traced the problem so far, the cause is your 207.218.245.28 router/firewall/whatever it is

3rd try, 8AM
Emailed the issue to abuse@ as the live chat wasn't able to tell the a working email address of their network dept. I got no automatic reply, not even read receipt.

Time is either EST or PST, whatever timezone their live chat is running in.

 

[The Helper]

Yes, it appears The Planet sucks. We are looking at alternatives. Thanks for all your help guys.

 

[Ur-Quan]

I couldn't enter the helper but now I can so I think it's fixed.
I'm from mid Europe.

 

[AceHart]

Well, for now.

Though,
" need to schedule a maintenance to properly repair this router (most likely Monday evening) "

Be prepared for more...

 

[enouwee]

Well, for now.

Though,
" need to schedule a maintenance to properly repair this router (most likely Monday evening) "

Be prepared for more...

Awww, c'mon. It's only a routine maintenance.
There can't be anything that could go wr......!!-?*`!/+%! [NO CARRIER]

Seriously thou, you should insist on getting a formal report (not as in: okaaay, weeeell, I push that big red button and then there was that bright flash and everything went dark). Check the SLA for possible compensations. Some hosters engage themselves in paying like 1.5% of the monthly fee per hour exceeding the maximum allowed downtime.

 

[AceHart]

Don't make me post the ticket here... I'd have to comment it ( "Parental advisory: explicit lyrics" ).

I expect the "report" to be along the lines of "We fixed it. Does it work?".