Eclipse issues

[scott]

Originally Posted by Gator_Support

Everyone that was on the .98 ip is now on 69.93.47.100 and once again up. We will eventually go back to the .98 and the minute the attack comes back if and when it does we do we can switch back to the .100 ip.

This problem has been solved.

If you have any questions please let us know.

I certainly have a few questions:

1) I have so far migrated about 5 of the 17 sites I have on a previous reseller account with another host. I just spent about 2 days convincing a customer that I have had for over 2 years that this move would be the best thing to happen since sliced bread. Just as we are about to start I have to explain to him that I can't set up his new account.... why? Well, you guess! Nearly two whole days of downtime is atrocious!

2) You've "fixed" the problem by changing IP's - why was this not done right at the start of the attack? It certainly did seems obvious to you at the time that it was a very automated DOS

3) I mentioned to one of my friends in the industry that at least I won't have to pay for my next month of hosting, he scoffed and said that American hosts don't consider DOS their problem, and won't refund as per their 99.9% "Guarantees" - Is this really the case?

Before you answer question #3 - think of the longterm value of a customer on your reseller plan...

[greenman]

First of all, thank you, Brent, for the return call.

I've restarted my router, restarted my system, flushed the browser cache, flushed the system dns cache (xp: ipconfig /flushdns), and still can't bring my sites up. Am I missing something? If the domains name servers are still pointing to .98 & .99, wouldn't that have to be changed to use the new IP, or are you able to redirect on your end?

William

[greenman]

OK, I just tried pinging 69.93.47.98 (eclipse) and had 100% loss. Then I pinged 69.93.47.100 and had 100% success. Then I pinged fullcircletaos.com (one of my sites): 100% loss, and tried taos-web-hosting.com (another one of mine); 100% loss - they're still resolving to the .98 IP.

Please enlighten me, someone.
And put some grumpier emoticons back up! :?

William

[greenman]

OK, now the sites try to come up, but all I get is a "broken graphic" indicator, which links to this url: http://www.xl-works.com/

huh??

[paintman]

I see that other folks have been having problems for a few days. Mine have been minimal (just a question of timing I guess) until this afternoon.
But now they are hurting me. I hope this can be resolved soon.

[GatorBrent]

Dos is hitting the .100 ip everyone is on now. Sites are down but this is a MAJOR break for us. This means we are still hosting someones site an army of zombie pc's is attacking.

At this moment we are dividing everyone on the server to a ton of different ips. The next time they attack they'll hit the new ip again and we will have a small group of sites who could be it. We will then take this small group and repeat the process giving them all dedicated ips and wait for the attack again.
Great news everyone! We'll know who theyre after soon, boot them, and be done with the worst dos in the history of HG.

[paintman]

Thank you Support... You said soon. I understand this is a divide and redivide and redivide process. Can you give me some idea (I wont hold you to it) of what "soon" means?

Thank you.

[Buckshot]

Will there be any refunds for this month due to the hours of downtime or do we have to request it by email?

[GatorJustin]

If you were affected by this downtime, send your account info (name and domain) to sales@hostgator.com Please place "Refund for Eclipse Downtime" in the subject line.

This refund applies to accounts hosted on the Eclipse server only.

-Justin

[vtrain]

Has the zombie magnet host been identified and the problem solved?
Will we get back to the original IP address?

Thanks,

Vtrain

[vtrain]

after some years with this configuration I'm having a problem that seems related with what was done here to solve the problem. I cannot explain what it is because it worked all along last years.

Since this outage I have clients on my reseller account on

69.93.47.98 (default IP address)
and some others on
69.93.47.103 (HG changed to find out which client was bringing problems to the server, it was not me ).

Today some of my sites do not work. All of then that are hosted on 69.93.47.98 (also the eclipse.websitewelcome.com domain) give problems inside The Planet Network:

Tracing route to eclipse.websitewelcome.com [69.93.47.98]
over a maximum of 30 hops:

1 13 ms <1 ms <1 ms 192.168.0.10
2 48 ms 42 ms 51 ms 212.0.167.78
3 * * 68 ms 213-205-75-222.nr.ip.pt [213.205.75.222]
4 68 ms 51 ms 48 ms 213-205-75-94.nr.ip.pt [213.205.75.94]
5 58 ms 48 ms 78 ms 208.49.160.241
6 80 ms 64 ms 54 ms so1-0-0-2488M.ar1.CDG3.gblx.net [67.17.75.206]
7 57 ms 54 ms 55 ms ge-3-2.core1.Paris1.Level3.net [4.68.127.97]
8 61 ms 55 ms 54 ms ae-0-51.mp1.Paris1.Level3.net [212.73.240.1]
9 181 ms 206 ms 186 ms as-0-0.bbr2.Dallas1.Level3.net [64.159.0.137]
10 250 ms 307 ms 219 ms ae-24-52.car4.Dallas1.Level3.net [4.68.122.48]
11 185 ms 202 ms 195 ms 4.78.224.14
12 196 ms 184 ms 188 ms vl31.dsr01.dllstx3.theplanet.com [70.85.127.29]

13 190 ms 225 ms 184 ms vl21.dsr01.dllstx2.theplanet.com [70.85.127.67]

14 217 ms 182 ms 187 ms vl1.car07.dllstx2.theplanet.com [12.96.160.22]
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 ^C

C:\Documents and Settings\Vtrain>tracert andrelevy.net

Tracing route to andrelevy.net [69.93.47.98]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.0.10
2 24 ms 22 ms 58 ms 212.0.167.78
3 58 ms 50 ms 51 ms 213-205-75-222.nr.ip.pt [213.205.75.222]
4 60 ms 51 ms 47 ms 213-205-75-94.nr.ip.pt [213.205.75.94]
5 42 ms 47 ms 40 ms 208.49.160.241
6 78 ms 88 ms 61 ms so0-0-0-2488M.ar1.CDG3.gblx.net [67.17.75.202]
7 61 ms 54 ms 62 ms ge-3-2.core1.Paris1.Level3.net [4.68.127.97]
8 61 ms 55 ms 62 ms ae-0-51.mp1.Paris1.Level3.net [212.73.240.1]
9 181 ms 194 ms 198 ms as-0-0.bbr2.Dallas1.Level3.net [64.159.0.137]
10 201 ms 216 ms 180 ms ae-14-53.car4.Dallas1.Level3.net [4.68.122.80]
11 184 ms 185 ms 201 ms 4.78.224.14
12 202 ms 217 ms 183 ms vl31.dsr01.dllstx3.theplanet.com [70.85.127.29]

13 184 ms 184 ms 206 ms vl21.dsr01.dllstx2.theplanet.com [70.85.127.67]

14 214 ms 203 ms 215 ms vl1.car07.dllstx2.theplanet.com [12.96.160.22]
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * ^C

and all other on the same address.

But the ones that are on 69.93.47.103 work !!

Tracing route to enguitaonline.com [69.93.47.103]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.0.10
2 26 ms 54 ms 25 ms 212.0.167.78
3 * 67 ms 51 ms 213-205-75-254.nr.ip.pt [213.205.75.254]
4 57 ms 47 ms 25 ms 213-205-75-30.nr.ip.pt [213.205.75.30]
5 71 ms 51 ms 49 ms 208.49.160.241
6 54 ms 73 ms 54 ms so1-0-0-2488M.ar1.CDG3.gblx.net [67.17.75.206]
7 59 ms 60 ms 56 ms ge-3-2.core1.Paris1.Level3.net [4.68.127.97]
8 56 ms 54 ms 69 ms ae-0-55.mp1.Paris1.Level3.net [212.73.240.97]
9 214 ms 217 ms 214 ms ae-0-0.bbr1.Dallas1.Level3.net [64.159.1.109]
10 201 ms 180 ms 193 ms ae-14-51.car4.Dallas1.Level3.net [4.68.122.16]
11 190 ms 186 ms 188 ms 4.78.221.146
12 182 ms 192 ms 197 ms vl31.dsr01.dllstx3.theplanet.com [70.85.127.29]

13 200 ms 219 ms 188 ms vl21.dsr01.dllstx2.theplanet.com [70.85.127.67]

14 198 ms 187 ms 200 ms vl1.car07.dllstx2.theplanet.com [12.96.160.22]
15 187 ms 199 ms 220 ms 103.69-93-47.reverse.theplanet.com

Chat Support told me first that is DNS propagation on my side. But I do not see that. What do others thing? I have a couple of important clients sites down for more then one hour now

cheers,

Vt.

EDIT

Adding ticket number: ARK-236162

[vtrain]

can someone, here in the forum, check this from a different location?

Thanks,

Vt.

[quietFinn]

Originally Posted by vtrain

can someone, here in the forum, check this from a different location?

Thanks,

Vt.

No problems from here (Finland)

[vtrain]

Unfortunally their is still no solution. I know now that in Finland (Thanks quietFinn) and on one research center in France the sites answer ok. But from the ISP where I am now... and from another one also here in Portugal they do not if they are on 69.93.47.98 (eclipse.websitewelcome.com does not answer).

After 5 answers from support lvl-1 I got the 6th from lvl-2 telling me that traceroute is no good because they blocked UDP ports on the router to protect the server. It is said to use ping instead. But ping was what I used on the first place and they asked me to use traceroute?

well, half of my sites are still ok and the other half is only not working in some ISPs. The whole thing is strange. I know HG is not responsible for external companies routing... but for me (I do not know as much as a professional sys admin) it's strange to see to IP addresses very close to one another and... one answers and the other does not.

disapointed ....

Vt.

[EDIT]
The problem was on my end and was a blacklist on my router everytime I used DW ftp sync feature. The details here:
http://forums.hostgator.com/showthre...9171#post29171