Unusual connection attempts FROM srv3.bakerlab.org

Message boards : Number crunching : Unusual connection attempts FROM srv3.bakerlab.org

To post messages, you must log in.

AuthorMessage
BitSpit
Avatar

Send message
Joined: 5 Nov 05
Posts: 33
Credit: 4,147,344
RAC: 0
Message 44096 - Posted: 23 Jul 2007, 10:51:17 UTC

Had to reboot my router this morning. Seems I'm getting flooded with connection attempts from srv3.bakerlab.org. Here's a short sample from the first five minutes after rebooting the router.

Mon Jul 23 04:33:40 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57281
Mon Jul 23 04:33:40 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57283
Mon Jul 23 04:33:49 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:52 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:58 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:58 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:01 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:07 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:10 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:34:19 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:28 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57281
Mon Jul 23 04:34:28 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57283
Mon Jul 23 04:34:34 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:34:43 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:35:22 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:35:31 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:35:52 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:35:55 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:00 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:01 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:03 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:09 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:13 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:37 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:45 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:37:25 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:37:33 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:38:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57339
Mon Jul 23 04:38:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57341
ID: 44096 · Rating: 0 · rate: Rate + / Rate - Report as offensive    Reply Quote
Mod.Sense
Volunteer moderator

Send message
Joined: 22 Aug 06
Posts: 4018
Credit: 0
RAC: 0
Message 44112 - Posted: 23 Jul 2007, 14:22:54 UTC

That's not normal. I've EMailed the system admin on the team to see if they can turn up the cause.

As you probably know, the way BOINC works, all accesses are initiated from your PC. Just the same way your browser works. The server does not have any way to contact your PC directly. So this must be a network issue of some kind.

At this point there doesn't seem to be any response from that server. So perhaps they already had discovered it was misbehaving.
Rosetta Moderator: Mod.Sense
ID: 44112 · Rating: 0 · rate: Rate + / Rate - Report as offensive    Reply Quote
Profile Keith E. Laidig
Volunteer moderator
Project developer
Avatar

Send message
Joined: 1 Jul 05
Posts: 154
Credit: 117,189,961
RAC: 0
Message 44114 - Posted: 23 Jul 2007, 14:29:54 UTC - in response to Message 44096.  
Last modified: 23 Jul 2007, 15:09:18 UTC

I'm giving SRV3 a close look now. This appears to be a caching issue (the server trying to address requests for webpages some long period of time after the request was made)... more when I finish up.

Thanks for the information on the server's behavior... -KEL

Update

Well, SRV3 is back to it's usual/proper behavior (I took this downtime/opportunity to update the OS as well). The cause of the apparent troubles was a tremendous backlog of webpages requests that SRV3 was unable to manage in a timely manner. As a result, the machine appeared - in specific instances - to be sending out unrequested packets...

The origin of the trouble is our preparation to upgrade the back-end fileserver to R@H. Our good RAID/SCSI fileserver is just barely able to keep up with all of your efforts. David B has decided to invest in replacing this fileserver with a fiber SAN solution and we've been trying to prepare for the change over by synchronizing the existing data onto the SAN (more details once we're done). This synch'ing of the data is hard on the system and can lead to large loads on the various components - as we saw last night.

I apologize to the RAH user base for this (unanticipated) problem. We try very hard not to cause any problem on the user end...

We'll try to get the move to the SAN done very soon!

-KEL

Had to reboot my router this morning. Seems I'm getting flooded with connection attempts from srv3.bakerlab.org. Here's a short sample from the first five minutes after rebooting the router.

Mon Jul 23 04:33:40 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57281
Mon Jul 23 04:33:40 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57283
Mon Jul 23 04:33:49 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:52 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:58 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:33:58 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:01 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:07 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:10 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:34:19 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:34:28 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57281
Mon Jul 23 04:34:28 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57283
Mon Jul 23 04:34:34 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:34:43 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:35:22 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57293
Mon Jul 23 04:35:31 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57297
Mon Jul 23 04:35:52 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:35:55 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:00 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:01 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:03 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:09 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:13 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:36:37 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:36:45 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:37:25 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57313
Mon Jul 23 04:37:33 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57317
Mon Jul 23 04:38:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57339
Mon Jul 23 04:38:21 2007 Blocked access attempt from 140.142.20.111:80 to TCP port 57341



ID: 44114 · Rating: 0 · rate: Rate + / Rate - Report as offensive    Reply Quote
FluffyChicken
Avatar

Send message
Joined: 1 Nov 05
Posts: 1260
Credit: 369,635
RAC: 0
Message 44149 - Posted: 24 Jul 2007, 10:04:15 UTC

Nice to see problem (especially unknown problems) fixed :)

Keith, also feel free to expand on your server setup, I know there would be plenty of people here that would like all the ins and outs ;)
Team mauisun.org
ID: 44149 · Rating: 0 · rate: Rate + / Rate - Report as offensive    Reply Quote

Message boards : Number crunching : Unusual connection attempts FROM srv3.bakerlab.org



©2024 University of Washington
https://www.bakerlab.org