Wierd problem

piersk

Has anyone come across this problem before:

I get an email from our monitoring software (Servers Alive, an excellent piece of kit) which says that one of our webservers is down. So I open up pcAnywhere and find that I can connect to it. I open up one of the websites on it: no probs.

However, when I ping it (which is what Servers Alive is doing) and I get "Request timed out".

It's not a big deal, cos the websites are working, but I'm curious to see if anyone has come across this before, cos I'm conpletely confuddled!

😕 <-- Piers being confuddled

bad76

Hi,
never hear it before.

Is there some firewall beetween you and this host that can block PING service?

Maybe you receive some ping_of_death...

It's really weird...

see you

/However you want know another weird problem:
Deleting session using cookie! #@!?O

drawmack

sounds like your ping port is closed

piersk

I'ev always been able to ping it before. It suddenly went at about 5 to 10 this morning.

bad76

I'm reaaallllyyyy sorry for you,
but sound like this 🙂

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

/another virus? try to open a session using coookie... never die! #@!?O

piersk

Ta for the update. I'm scanning my server as we speak. One point tho, if I'd patched my server against DCOM exploits (which I did, last week) can I still get this new one.

bad76

Originally posted by piersk
One point tho, if I'd patched my server against DCOM exploits (which I did, last week) can I still get this new one.

Yes, i've read this on mcafee or symantec site,
but don't find it now...

:o <-- Piers being virused :LOL:

piersk

Also I have SP4 installed, which would imply that the other vunerability would be blocked (I've tried re-downloading the patch but it says that the SP would cover it so to speak)

Oh, and one more thing: I can ping from my server to another one, but I still can't ping to it.

Update: I ran the symantec fis for the virus, but it said that it wasn't there. hmmm....

drawmack

I'm telling you check the port

piersk

Already have done. I checked with the consulting company we use (thats where our server is located, behind a firewall) and they haven't blocked it.

drawmack

try focing a ping on another port (80?) into the machine and see if it works. Then try using a port scanner on the machine and see what happens when you scan the ping port.

bad76

Try to look with traceroute where packets are losts.

drawmack

If he is getting there with a webbrowser then trace route probably is not going to fail. But I think I see the problem:

Also I have SP4 installed, which would imply that the other vunerability would be blocked (I've tried re-downloading the patch but it says that the SP would cover it so to speak)

Sounds like it's a windows box.

bad76

Traceroute is a PING with deathtime +1 at each step.

piersk

Originally posted by drawmack
Sounds like it's a windows box.

d'ya reckon? 😉

Just had a look and its being blocked at our adsl host provider. Will have to check with them methinks.

bad76

May be your adsl host provider is infected 🙂

:o <- "your adsl host provider" being infected 😃

piersk

Could be... Not worried bout that now. I've just had about 30 emails come through in the space of about an hour (there's only 9 people working here, so thats quite a few) that have the sobig virus (or at least did until they went through our gateway 😃 )

Elizabeth

Yes, we have a guy here with the sobig virus emails today too, but so far no server probs.

bad76

Yuppies!
My lan too is under attack. Already 20/30 pc are infected, firewall and server comprised!

😃