Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2741 > unrolled thread

can't access a service to a remate hosts

Back to article view | Back to comp.os.linux.networking

Contents

  can't access a service to a remate hosts xeon Mailinglist <xeonmailinglist@gmail.com> - 2014-02-23 06:30 -0800
    Re: can't access a service to a remate hosts Ulf Volmer <u.volmer@u-v.de> - 2014-02-23 15:39 +0100
      Re: can't access a service to a remate hosts xeon Mailinglist <xeonmailinglist@gmail.com> - 2014-02-23 06:55 -0800
        Re: can't access a service to a remate hosts Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2014-02-23 18:33 +0200
          Re: can't access a service to a remate hosts xeon Mailinglist <xeonmailinglist@gmail.com> - 2014-02-23 09:33 -0800
            Re: can't access a service to a remate hosts xeon Mailinglist <xeonmailinglist@gmail.com> - 2014-02-23 09:34 -0800
              Re: can't access a service to a remate hosts Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2014-02-23 20:03 +0200
                Re: can't access a service to a remate hosts Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-02-23 19:50 +0100
                  Re: can't access a service to a remate hosts Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2014-02-23 23:32 +0200
                    Re: can't access a service to a remate hosts Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-02-24 00:14 +0100
              Re: can't access a service to a remate hosts Andrew Gideon <c182driver9@gideon.org> - 2014-02-26 14:16 +0000
          Re: can't access a service to a remate hosts Joe Beanfish <joebeanfish@nospam.duh> - 2014-02-24 15:01 +0000
        Re: can't access a service to a remate hosts Ulf Volmer <u.volmer@u-v.de> - 2014-02-23 19:15 +0100
          Re: can't access a service to a remate hosts Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-02-23 19:46 +0100
        Re: can't access a service to a remate hosts William Unruh <unruh@invalid.ca> - 2014-02-23 19:48 +0000
    Re: can't access a service to a remate hosts William Unruh <unruh@invalid.ca> - 2014-02-23 19:47 +0000

#2741 — can't access a service to a remate hosts

I have this network. host1 <-> router1 <-> router2 <-> router3 <-> router4 <-> host2. I  can ping from host1 to host2, but I can access a service that is running in the port 50070. How can I find what is going on? I don't have access to the routers, only to the hosts.

Both hosts run linux in terminal mode.

[toc] | [next] | [standalone]

#2742

xeon Mailinglist <xeonmailinglist@gmail.com> schrieb:
> I have this network. host1 <-> router1 <-> router2 <-> router3 <-> router4 <-> host2. I  can ping from host1 to host2, but I can access a service that is running in the port 50070. How can I find what is going on? I don't have access to the routers, only to the hosts.
>
> Both hosts run linux in terminal mode.

You can test with tcptraceroute if any route blocks your ports:

tcptracerouet host2 50070

regards
Ulf

[toc] | [prev] | [next] | [standalone]

#2743

I did tcptraceroute, and I get this output. It seems that it has connected, but when I access the service with a browser, I get Connection refused.

Am I reading right? The output got show that I connected to the destination?

HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070
traceroute to 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
 1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms  0.960 ms



On Sunday, February 23, 2014 2:39:01 PM UTC, Ulf Volmer wrote:
> xeon Mailinglist <xeonmailinglist@gmail.com> schrieb:
> 
> > I have this network. host1 <-> router1 <-> router2 <-> router3 <-> router4 <-> host2. I  can ping from host1 to host2, but I can access a service that is running in the port 50070. How can I find what is going on? I don't have access to the routers, only to the hosts.
> 
> >
> 
> > Both hosts run linux in terminal mode.
> 
> 
> 
> You can test with tcptraceroute if any route blocks your ports:
> 
> 
> 
> tcptracerouet host2 50070
> 
> 
> 
> regards
> 
> Ulf

[toc] | [prev] | [next] | [standalone]

#2744

On 23.2.14 16:55, xeon Mailinglist wrote:
> I did tcptraceroute, and I get this output. It seems that it has connected, but when I access the service with a browser, I get Connection refused.
>
> Am I reading right? The output got show that I connected to the destination?
>
> HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070
> traceroute to 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
>   1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms  0.960 ms

The target host (10.103.0.20) refused the TCP connection.
Are you sure that there is anything listening tp port 50070?

-- 

Tauno Voipio

[toc] | [prev] | [next] | [standalone]

#2745

Yes, i am. I accessed the service from the machine. 

[toc] | [prev] | [next] | [standalone]

#2746

I just can't access the service from a remote hosts.

[toc] | [prev] | [next] | [standalone]

#2747

On 23.2.14 19:34, xeon Mailinglist wrote:
> I just can't access the service from a remote hosts.


Are you sure that the accessed host is what you think it is?

The 10.x.y.z are RFC1918 private addresses, which can mean
different hosts in different local networks. If the routers
obey the RFC's, they must not forward the 10 -series addresses
if there is any hop in the public network.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#2750

Tauno Voipio a écrit :
> 
> Are you sure that the accessed host is what you think it is?

Wise question.

> The 10.x.y.z are RFC1918 private addresses, which can mean
> different hosts in different local networks. If the routers
> obey the RFC's, they must not forward the 10 -series addresses
> if there is any hop in the public network.

Agreed, but then they should not reply with a TCP RST, should they ?

[toc] | [prev] | [next] | [standalone]

#2754

On 23.2.14 20:50, Pascal Hambourg wrote:
> Tauno Voipio a écrit :
>>
>> Are you sure that the accessed host is what you think it is?
>
> Wise question.
>
>> The 10.x.y.z are RFC1918 private addresses, which can mean
>> different hosts in different local networks. If the routers
>> obey the RFC's, they must not forward the 10 -series addresses
>> if there is any hop in the public network.
>
> Agreed, but then they should not reply with a TCP RST, should they ?


That's right, but it is prefectly correct to have a host
with the targeted IP in the network he's attempting access
from, so the SYN segment goes to a completely different
host the OP is targeting.

There is a clue in this direction in the trace he posted:
the RST comes from the address he wants to connect to, but
without the router hops he claims there are.

The RST comes from an unprepared host or from a firewall
which is configured to assassin TCP to unallowed ports.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#2755

Tauno Voipio a écrit :
> On 23.2.14 20:50, Pascal Hambourg wrote:
>>
>>> The 10.x.y.z are RFC1918 private addresses, which can mean
>>> different hosts in different local networks. If the routers
>>> obey the RFC's, they must not forward the 10 -series addresses
>>> if there is any hop in the public network.
>> Agreed, but then they should not reply with a TCP RST, should they ?
> 
> That's right, but it is prefectly correct to have a host
> with the targeted IP in the network he's attempting access
> from, so the SYN segment goes to a completely different
> host the OP is targeting.
> 
> There is a clue in this direction in the trace he posted:
> the RST comes from the address he wants to connect to, but
> without the router hops he claims there are.

Unlike ICMP errors, a TCP RST always appears to come from the target
address, even when sent by an intermediate firewall. Otherwise the
original sender would not accept it.

> The RST comes from an unprepared host or from a firewall
> which is configured to assassin TCP to unallowed ports.

Not from the expected destination host, anyway.

[toc] | [prev] | [next] | [standalone]

#2758

On Sun, 23 Feb 2014 09:34:27 -0800, xeon Mailinglist wrote:

> I just can't access the service from a remote hosts.

Try "lsof -p 50070" on the listening host.  The listerer may be listening 
only on the localhost IP (or some other set of IPs not including the one 
to which you are attempting to connect).

	- Andrew

[toc] | [prev] | [next] | [standalone]

#2756

On Sun, 23 Feb 2014 18:33:21 +0200, Tauno Voipio wrote:

> On 23.2.14 16:55, xeon Mailinglist wrote:
>> I did tcptraceroute, and I get this output. It seems that it has
>> connected, but when I access the service with a browser, I get
>> Connection refused.
>>
>> Am I reading right? The output got show that I connected to the
>> destination?
>>
>> HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070 traceroute to
>> 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
>>   1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms 
>>   0.960 ms
> 
> The target host (10.103.0.20) refused the TCP connection. Are you sure
> that there is anything listening tp port 50070?

Perhaps the server is bound to localhost only? On the server try
   netstat -nlp |grep :50070
to check it out.

[toc] | [prev] | [next] | [standalone]

#2748

xeon Mailinglist <xeonmailinglist@gmail.com> schrieb:
> I did tcptraceroute, and I get this output. It seems that it has connected, but when I access the service with a browser, I get Connection refused.
>
> Am I reading right? The output got show that I connected to the destination?
>
> HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070
> traceroute to 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
>  1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms  0.960 ms
                                         ^^^

The server refuse your connection. Is the Server listening on the right (all) 
interfaces?
Are there any firewall on the server?

regards
Ulf

[toc] | [prev] | [next] | [standalone]

#2749

Ulf Volmer a écrit :
> xeon Mailinglist <xeonmailinglist@gmail.com> schrieb:
>> I did tcptraceroute, and I get this output. It seems that it has connected

No it's not. rst = RESET = connection refused.

>> Am I reading right? The output got show that I connected to the destination?

Not quite. It stopped a the first hop, not even reaching the finale
destination (unless all routers along the path do not decrease the TTL,
which would be against the IP standard).

>> HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070
>> traceroute to 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
>>  1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms  0.960 ms
>                                          ^^^
> The server refuse your connection.

Nope. The first hop refused the connection.

[toc] | [prev] | [next] | [standalone]

#2752

On 2014-02-23, xeon Mailinglist <xeonmailinglist@gmail.com> wrote:
> I did tcptraceroute, and I get this output. It seems that it has connected, but when I access the service with a browser, I get Connection refused.

That is a different issue. The program listening to port 50070 is
refusing the connection. Look at that program ( which you never told us
about)

>
> Am I reading right? The output got show that I connected to the destination?
>
> HadoopWorkers-rci-0:~# tcptraceroute 10.103.0.20 50070
> traceroute to 10.103.0.20 (10.103.0.20), 30 hops max, 60 byte packets
>  1  HadoopWorkers-fiu-0 (10.103.0.20) <rst,ack>  1.087 ms  1.016 ms  0.960 ms
>
>
>
> On Sunday, February 23, 2014 2:39:01 PM UTC, Ulf Volmer wrote:
>> xeon Mailinglist <xeonmailinglist@gmail.com> schrieb:
>> 
>> > I have this network. host1 <-> router1 <-> router2 <-> router3 <-> router4 <-> host2. I  can ping from host1 to host2, but I can access a service that is running in the port 50070. How can I find what is going on? I don't have access to the routers, only to the hosts.
>> 
>> >
>> 
>> > Both hosts run linux in terminal mode.
>> 
>> 
>> 
>> You can test with tcptraceroute if any route blocks your ports:
>> 
>> 
>> 
>> tcptracerouet host2 50070
>> 
>> 
>> 
>> regards
>> 
>> Ulf
>

[toc] | [prev] | [next] | [standalone]

#2751

On 2014-02-23, xeon Mailinglist <xeonmailinglist@gmail.com> wrote:
> I have this network. host1 <-> router1 <-> router2 <-> router3 <-> router4 <-> host2. I  can ping from host1 to host2, but I can access a service that is running in the port 50070. How can I find what is going on? I don't have access to the routers, only to the hosts.

routers running firewall? Nothing on host 2 listening to port 50070?

tcpdump on host 2 to see if packets coming through.

>
> Both hosts run linux in terminal mode.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web