[outages] secureserver.net down

[Jeremy Chadwick]

"Bad file descriptor" could indicate the TCP socket is being abruptly
closed by the remote end (server), or probably a timeout; hard to say on
Windows (no offence of course).

Let's see from *IX:

$ curl -L -v http://www.secureserver.net/
* Hostname was NOT found in DNS cache
*   Trying 208.109.4.208...
* Connected to www.secureserver.net (208.109.4.208) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.36.0
> Host: www.secureserver.net
> Accept: */*
>
< HTTP/1.1 302 Object moved
< Cache-Control: private
< Content-Length: 153
< Content-Type: text/html
< Location: http://default.secureserver.net/
* Server Microsoft-IIS/7.0 is not blacklisted
< Server: Microsoft-IIS/7.0
< Set-Cookie: ASPSESSIONIDSSAQCARD=OBLEBDKAKDNLKIHLMGNJNADK; path=/
< X-Powered-By: ASP.NET
< Date: Tue, 20 May 2014 02:50:58 GMT
<
* Ignoring the response-body
* Connection #0 to host www.secureserver.net left intact
* Issue another request to this URL: 'http://default.secureserver.net/'
* Hostname was NOT found in DNS cache
*   Trying 68.178.232.99...
^C

And from that point it just sits there -- no response to TCP SYN;
tcpdump verification:

19:52:40.518979 IP 192.168.1.51.41206 > 68.178.232.99.80: Flags [S], seq 547856610, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 502406310 ecr 0], length 0
19:52:43.518913 IP 192.168.1.51.41206 > 68.178.232.99.80: Flags [S], seq 547856610, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 502409310 ecr 0], length 0
19:52:46.718910 IP 192.168.1.51.41206 > 68.178.232.99.80: Flags [S], seq 547856610, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 502412510 ecr 0], length 0

I have no idea what "proper" behaviour is (i.e. no idea if the HTTP 302
is normal, no idea if default.secureserver.net is the normal FQDN
redirection destination, no idea if the IPs in question are correct
(e.g. DNS hijacking, whatever)), just proving some technical insight.

-- 
| Jeremy Chadwick                                   jdc at koitsu.org |
| UNIX Systems Administrator                http://jdc.koitsu.org/ |
| Making life hard for others since 1977.             PGP 4BD6C0CB |

On Mon, May 19, 2014 at 09:45:37PM -0500, Frank Bulk wrote:
> I'm not sure what site that last two posters are referring to, as no real
> details are given, but hitting www.secureserver.net
> <http://www.secureserver.net>  gives me this:
> 
>  
> 
> C:\Users\Frank Bulk>wget -4 www.secureserver.net
> 
> --2014-05-19 21:43:56--  http://www.secureserver.net/
> 
> Resolving www.secureserver.net (www.secureserver.net)... 208.109.4.208
> 
> Connecting to www.secureserver.net
> (www.secureserver.net)|208.109.4.208|:80... connected.
> 
> HTTP request sent, awaiting response... 302 Object moved
> 
> Location: http://default.secureserver.net/ [following]
> 
> --2014-05-19 21:43:56--  http://default.secureserver.net/
> 
> Resolving default.secureserver.net (default.secureserver.net)...
> 68.178.232.99
> 
> Connecting to default.secureserver.net
> (default.secureserver.net)|68.178.232.99|:80... failed: Bad file descriptor.
> 
> Retrying.
> 
>  
> 
> --2014-05-19 21:44:17--  (try: 2)  http://default.secureserver.net/
> 
> Connecting to default.secureserver.net
> (default.secureserver.net)|68.178.232.99|:80... failed: Bad file descriptor.
> 
> Retrying.
> 
>  
> 
> --2014-05-19 21:44:38--  (try: 3)  http://default.secureserver.net/
> 
> Connecting to default.secureserver.net
> (default.secureserver.net)|68.178.232.99|:80... failed: Bad file descriptor.
> 
>  
> 
> Etc.
> 
>  
> 
> Frank
> 
>  
> 
> From: Outages [mailto:outages-bounces at outages.org] On Behalf Of Eric Henson
> Sent: Monday, May 19, 2014 9:30 PM
> To: *Network; outages at outages.org
> Subject: Re: [outages] secureserver.net down
> 
>  
> 
> I can't hit their website, from Dallas area.
> 
>  
> 
> -- 
> ERIC HENSON
> Solutions Architect for Systems Organization
> 
> PFSweb  |   <http://www.pfsweb.com/> www.pfsweb.com
> p:  972.881.2900  x3104
> m: 972.948.3424
> 
>  
> 
> From: Outages [mailto:outages-bounces at outages.org] On Behalf Of *Network
> Sent: Monday, May 19, 2014 7:47 PM
> To: outages at outages.org <mailto:outages at outages.org> 
> Subject: [outages] secureserver.net down
> 
>  
> 
> We are seeing issues with secureserver.net in the midwest. Symptoms include
> slow response times, DNS timeouts, and registrar functions seem to be
> unavailable.  Whois database appears to be impacted as well.  Is anyone else
> experiencing these symptoms...?? 
> 
>  
> 
>  Ryan O'Shea | Director of Technology | VCP5 - RHCE
> 
>  
> 
>  <mailto:support at cisp.com> support at cisp.com |  <http://www.cisp.com/>
> www.cisp.com
> 
> 
> ------------------------
> This email was scanned by BitDefender.
> 
> 
> ------------------------
> This email was scanned by BitDefender.
> 

> _______________________________________________
> Outages mailing list
> Outages at outages.org
> https://puck.nether.net/mailman/listinfo/outages