routing issue?

[#1]

My broadband is mainly working fine, but I can't access one site, programbits.co.uk

(hosted by Penguin Internet)

I can access it via proxy so the site must be working OK, and dns is working.

This has been going on for 24 hours now; not just an intermittent glitch.

I assume there is some kind of routing problem?

Any ideas?

tracert posted below.

C:\GoldsmithsSVN\aaorganicart\organicart>tracert programbits.co.uk

Tracing route to programbits.co.uk [91.207.50.20]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms bthub [192.168.1.254]
2 4 ms 4 ms 4 ms 172.16.14.105
3 * * * Request timed out.
4 8 ms 8 ms 8 ms 132.hiper04.sheff.dial.plus.net.uk [195.166.143.132]
5 8 ms 8 ms 8 ms peer7-et-4-0-4.telehouse.ukcore.bt.net [194.72.16.128]
6 7 ms 7 ms 7 ms 166-49-214-194.gia.bt.net [166.49.214.194]
7 * * * Request timed out.
8 9 ms 8 ms 8 ms be2398.ccr21.lon01.atlas.cogentco.com [130.117.51.209]
9 8 ms 8 ms 8 ms 149.6.2.138
10 13 ms 12 ms 12 ms sv7.unicorn1.hns.net [31.210.132.9]
11 12 ms 11 ms 11 ms sv170.unicorn0.hns.net [31.210.132.53]
12 12 ms 11 ms 11 ms sv175.ngd0.hns.net [31.210.132.57]
13 * * * Request timed out.
14 * * * Request timed out.

[#2]

Hi I can connect to that site, here is my tracert programbits.co.uk

Tracing route to programbits.co.uk [91.207.50.20]
over a maximum of 30 hops:

1 3 ms 1 ms 2 ms dsldevice.lan [192.168.1.254]
2 11 ms 9 ms 9 ms 195.166.130.255
3 12 ms 10 ms 9 ms 84.93.253.127
4 11 ms 10 ms 9 ms 195.99.125.138
5 19 ms 9 ms 9 ms peer7-et-7-0-2.telehouse.ukcore.bt.net [109.159.252.88]
6 11 ms 10 ms 10 ms 166-49-214-194.gia.bt.net [166.49.214.194]
7 * * * Request timed out.
8 12 ms 10 ms 10 ms be2398.ccr21.lon01.atlas.cogentco.com [130.117.51.209]
9 12 ms 9 ms 10 ms 149.6.2.138
10 15 ms 14 ms 14 ms sv7.unicorn1.hns.net [31.210.132.9]
11 18 ms 14 ms 13 ms sv170.unicorn0.hns.net [31.210.132.53]
12 15 ms 14 ms 14 ms sv175.ngd0.hns.net [31.210.132.57]
13 15 ms 14 ms 13 ms server2.pcs-net.com [91.207.50.20]

Trace complete.

You could try dropping you broadband connection to see if your gateway changes from 172.16.14.105

Needs plusnet 'net ops' to take a look

Dan

[#3]

Thankyou.

I disconnected and reconnected but got the same gateway.

Will Plusnet netops see this automatically and do something about it?

Plusnet seem to have gone out of their way to make contacting them as hard as possible about it.

Stephen

[#4]

Hopefully someone from support will see your post.

It can be a bit hit and miss to be allocated another gateway and broadband IP address.

If you're not needing a connection over night an extended disconnect might do the trick.

It might be worth logging a fault https://faults.plus.net 

Dan.

[#5]

Thanks for your help again. That fault page leads into lots of questions that are irrelevant to the issue, with no way of just posting the issue. I can see it would help in quite a few situations

I knew Plusnet support had got worse over the years ... I did't realize how much worse. (not your fault at all, but a shame)

[#6]

Another one here who can reach the site (from an IP in the 80.229.0.0/16 range).

@sjptd - have you actually tried reaching the owner of the site/webhost? Your trace clearly shows traffic leaving the Plusnet network and making it all the way to the hop before the server the site is hosted at.

I cannot be certain but that's fairly suggestive the issue lies at the destination side. Could they be refusing connections from your IP address for some reason? 

[#7 · Accepted solution]

When I first saw this post last night, out of curiosity I tried the site, and could connect successfully to it (on both http and https - it was just a folder list if I remember, rather than a full website, but it connected fine). This morning it is not connecting, with a "time out".

My PlusNet IP has not changed (in 51.9.0.0/16) and a traceroute looks fine. I wonder if the site is having intermittent problems.

>tracert programbits.co.uk

Tracing route to programbits.co.uk [91.207.50.20]
over a maximum of 30 hops:

1 2 ms 2 ms 1 ms OpenWrtCB.home.arpa [192.168.203.1]
2 3 ms 2 ms 2 ms 192.168.1.254
3 * * * Request timed out.
4 * * * Request timed out.
5 14 ms 13 ms 13 ms 128.hiper04.sheff.dial.plus.net.uk [195.166.143.128]
6 30 ms 13 ms 13 ms peer7-et-0-1-6.telehouse.ukcore.bt.net [109.159.252.166]
7 14 ms 14 ms 14 ms 166-49-214-194.gia.bt.net [166.49.214.194]
8 * * * Request timed out.
9 15 ms 14 ms 14 ms be2398.ccr21.lon01.atlas.cogentco.com [130.117.51.209]
10 155 ms 16 ms 14 ms 149.6.2.138
11 18 ms 19 ms 19 ms sv7.unicorn1.hns.net [31.210.132.9]
12 18 ms 17 ms 17 ms sv170.unicorn0.hns.net [31.210.132.53]
13 21 ms 18 ms 18 ms sv175.ngd0.hns.net [31.210.132.57]
14 19 ms 19 ms 19 ms server2.pcs-net.com [91.207.50.20]

Trace complete.

[#8]

Thank you.

I didn't originally raise it with Penguin because I knew that there had been recent issues with some Plusnet routing that had been fairly quickly resolved.

It is my own site. I have now raised it with Penguin.

[#9]

Thanks, Penguin got back to me (11 mins after raising the ticket).

I'd changed the password to part of the site and not told my wife, so she gave the wrong password too many times and they blocked our IP. I'm not sure why the blocking didn't also involve a warning email to me as site owner.

Stephen

[#10]

---

@sjptd wrote:

I'm not sure why the blocking didn't also involve a warning email to me as site owner.

---

You may be the site owner but not the system owner. The people running Penguin would have seen the messages in the logs and just assumed it related to unauthorized login attempts.

[#11]

You may be the site owner but not the system owner. The people running Penguin would have seen the messages in the logs and just assumed it related to unauthorized login attempts.

I agree they were quite right to block our access on what they had to assume were unauthorized login attempts.

The logs must show the source ip and target site (name, not just ip). I don't know if the block to source ip was at the at the target site, or the entire target hosting machine, or even all their hosting machines; but the reason for the block was failed attempts at the target site, as trackable in the logs. As site owner it seems highly relevant to be notified if my site is being targetted.

Of course, I don't expect the people to do that kind of log analysis, but trivial for their program that is already doing it and (quite properly) blocking access.

I don't know the level of general attempts to gain unauthorised access to different websites, but I can't believe that there would be many attempts to crack a very minor site such as ours that would cause flooding of 'illegal access' emails.