1

My website is down for just me. tracert finds the server though it reports a different domain (and at 23 hops seems rather lengthy). ping works, citing the same IP as tracert. nslookupalso reports the same IP.

Web browsers, ssh and sftp all report "the connection has timed out".

I see same issue from multiple computers (all on same local network though; Windows 7 & 10).

I can connect to the control panel of my host (DreamHost) and access all the usual functions. Nothing is out of order there.

I can browse to the site using Lynx from a shell console on a server I have access to in another country. Webservices such as isup.me and Nibbler report no problem connecting the site.

This has happened a few times over the last couple of months. After half a day or so it works again. How do I narrow down where the actual issue is?

The website is www.yukongis.ca

Tracert and ping results (via WinMTR):

|------------------------------------------------------------------------------------------|
|                                      WinMTR statistics                                   |
|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |
|------------------------------------------------|------|------|------|------|------|------|
|                            gateway.mkcd -    0 |  823 |  823 |    0 |    0 |    0 |    0 |
|                          10.131.127.254 -    1 |  819 |  818 |    5 |   29 |  502 |    6 |
|                             10.11.64.25 -    0 |  822 |  822 |    5 |   23 |  522 |    9 |
|                              10.1.2.113 -    1 |  815 |  813 |   31 |   36 |  312 |   33 |
|                          64.230.219.141 -    1 |  819 |  818 |   31 |   36 |  310 |   33 |
|tcore4-edmonton_bundle-ether1.net.bell.ca -    1 |  819 |  818 |   48 |   55 |  334 |   52 |
|tcore3-vancouver_tengige0-15-0-5.net.bell.ca -    0 |  822 |  822 |   50 |   55 |  351 |   51 |
|tcore3-seattle_hundredgige0-5-0-0.net.bell.ca -    1 |  819 |  818 |   49 |   53 |  330 |   52 |
|             bx4-seattle_ae2.net.bell.ca -    0 |  822 |  822 |   49 |   59 |  540 |   51 |
|              206.111.7.17.ptr.us.xo.net -    1 |  819 |  818 |   49 |   53 |  415 |   53 |
|      vb2000d1.rar3.seattle-wa.us.xo.net -    0 |  822 |  822 |  109 |  114 |  409 |  113 |
|         ae0.rcb1.saltlake2-ut.us.xo.net -    0 |  822 |  822 |  108 |  112 |  406 |  110 |
|             207.88.12.144.ptr.us.xo.net -    0 |  822 |  822 |  112 |  116 |  408 |  113 |
|             207.88.12.190.ptr.us.xo.net -    1 |  819 |  818 |  111 |  120 |  591 |  116 |
|    te0-12-0-0.rar3.sanjose-ca.us.xo.net -    1 |  819 |  818 |  112 |  115 |  417 |  113 |
|             207.88.12.164.ptr.us.xo.net -    0 |  822 |  822 |  111 |  116 |  416 |  114 |
|             207.88.12.213.ptr.us.xo.net -    1 |  819 |  818 |  109 |  118 |  388 |  110 |
|             207.88.12.214.ptr.us.xo.net -    0 |  822 |  822 |  108 |  122 |  406 |  110 |
|             207.88.14.181.ptr.us.xo.net -    0 |  822 |  822 |  110 |  115 |  417 |  113 |
|                            209.48.43.58 -    1 |  819 |  818 |  113 |  116 |  392 |  114 |
|          ip-208-113-156-4.dreamhost.com -    1 |  819 |  818 |  112 |  115 |  393 |  114 |
|         ip-208-113-156-14.dreamhost.com -    0 |  822 |  822 |  111 |  116 |  409 |  113 |
|apache2-argon.thomas-lynch-jr.dreamhost.com -    0 |  822 |  822 |  113 |  116 |  410 |  115 |
|________________________________________________|______|______|______|______|______|______|
   WinMTR v0.92 GPL V2 by Appnor MSP - Fully Managed Hosting & Cloud Provider

Output of nslookup -d2:

------------
SendRequest(), len 42
    HEADER:
    opcode = QUERY, id = 1, rcode = NOERROR
    header flags:  query, want recursion
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    1.1.168.192.in-addr.arpa, type = PTR, class = IN

------------
------------
Got answer (68 bytes):
    HEADER:
    opcode = QUERY, id = 1, rcode = NOERROR
    header flags:  response, auth. answer, want recursion, recursion avail.
    questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
    1.1.168.192.in-addr.arpa, type = PTR, class = IN
    ANSWERS:
    ->  1.1.168.192.in-addr.arpa
    type = PTR, class = IN, dlen = 14
    name = gateway.mkcd
    ttl = 0 (0 secs)

------------
Server:  gateway.mkcd
Address:  192.168.1.1

------------
SendRequest(), len 38
    HEADER:
    opcode = QUERY, id = 2, rcode = NOERROR
    header flags:  query, want recursion
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca.mkcd, type = A, class = IN

------------
------------
Got answer (38 bytes):
    HEADER:
    opcode = QUERY, id = 2, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca.mkcd, type = A, class = IN

------------
------------
SendRequest(), len 38
    HEADER:
    opcode = QUERY, id = 3, rcode = NOERROR
    header flags:  query, want recursion
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca.mkcd, type = AAAA, class = IN

------------
------------
Got answer (113 bytes):
    HEADER:
    opcode = QUERY, id = 3, rcode = NXDOMAIN
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    www.yukongis.ca.mkcd, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  (root)
    type = SOA, class = IN, dlen = 64
    ttl = 569 (9 mins 29 secs)
    primary name server = a.root-servers.net
    responsible mail addr = nstld.verisign-grs.com
    serial  = 2017052801
    refresh = 1800 (30 mins)
    retry   = 900 (15 mins)
    expire  = 604800 (7 days)
    default TTL = 86400 (1 day)

------------
------------
SendRequest(), len 33
    HEADER:
    opcode = QUERY, id = 4, rcode = NOERROR
    header flags:  query, want recursion
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca, type = A, class = IN

------------
------------
Got answer (49 bytes):
    HEADER:
    opcode = QUERY, id = 4, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 1,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca, type = A, class = IN
    ANSWERS:
    ->  www.yukongis.ca
    type = A, class = IN, dlen = 4
    internet address = 208.113.218.229
    ttl = 12817 (3 hours 33 mins 37 secs)

------------
------------
SendRequest(), len 33
    HEADER:
    opcode = QUERY, id = 5, rcode = NOERROR
    header flags:  query, want recursion
    questions = 1,  answers = 0,  authority records = 0,  additional = 0

    QUESTIONS:
    www.yukongis.ca, type = AAAA, class = IN

------------
------------
Got answer (97 bytes):
    HEADER:
    opcode = QUERY, id = 5, rcode = NOERROR
    header flags:  response, want recursion, recursion avail.
    questions = 1,  answers = 0,  authority records = 1,  additional = 0

    QUESTIONS:
    www.yukongis.ca, type = AAAA, class = IN
    AUTHORITY RECORDS:
    ->  yukongis.ca
    type = SOA, class = IN, dlen = 52
    ttl = 445 (7 mins 25 secs)
    primary name server = ns1.dreamhost.com
    responsible mail addr = hostmaster.dreamhost.com
    serial  = 2017042704
    refresh = 19223 (5 hours 20 mins 23 secs)
    retry   = 1800 (30 mins)
    expire  = 1814400 (21 days)
    default TTL = 14400 (4 hours)

------------
Name:    www.yukongis.ca
Address:  208.113.218.229
3
  • Please post the output of nslookup -d2 example.com (replace example.com with your site name). May 28, 2017 at 19:34
  • post updated with nslookup -d2 output @Twisty. However it might not be helpful as I can connect to the site now. I rebooted the local router (gateway.mkcd in the above). I won't know if that was the likely fix until it goes down again. May 28, 2017 at 19:46
  • Agreed. Run the command the next time the lookup fails and update the question then. May 28, 2017 at 19:49

3 Answers 3

2

Are you using something like fail2ban on your server?

At least your problem looks like an anti abuse countermeasure, i.e. if one IP tries to connect to fast to the server it is being blocked for a certain time.

This would also explain why you can connect again after some time has passed.

Maybe your provider has something like this in place. You have to ask their support then.

1

There can be other than DNS issues:

  • Firewall-related: return-path problem (responses come for an alternate page of the site and don't get through Firewall when returning - can be traced with a browser monitor/tracer). This is a mistake in site design, usually corrected by owners.

  • Routing: You have routing influencing the destination IP (like EIGRP tunnels) and traffic is routed through a tunnel instead of exiting directly through ISP (can be checked by showing IP routes in the router configuration). This is fixable by adding a static route in the router (if your company, ISP, etc).

0

Sounds like you have a local DNS issue. I'm assuming you mean that everyone (outside your network) can access the website, but you. Then it points to something locally. A quick check to would be to force your DNS to change, so instead of a local, use 8.8.8.8

The other reason I'm assuming this is that it resolves after a day, most DNS update at midnight, and thus the issue is resolved the next day.

3
  • If DNS was broken then I would expect ping and tracert to fail also. I think something happened at the router or ISP that blocked some traffic but not others. Maybe certain port ranges? Anyway I'll have to wait for it to fail again before more testing. May 29, 2017 at 3:52
  • @mattwilkie Yes if it was broken it wouldn't route, but you can ping, thus it's not a matter of broken. It more of the data has been changed, thus causing a conflict. Again, it's a simple check, and that's what it points too.
    – JustAGrump
    May 29, 2017 at 3:54
  • most DNS update at midnight...This isn't true. Authoritative DNS records are updated the moment the domain admin makes a change. Cached DNS records are updated when their TTL expires. None of this is based on a pre-determined time of day. Jun 7, 2017 at 3:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .