<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 23/12/2015 19:44, Anurag Bhatia
wrote:<br>
</div>
<blockquote
cite="mid:CAJ0+aXZVckw8qoMZU9CNVjbUze0+p7xfpOZCDQKo3GdJWp2kUg@mail.gmail.com"
type="cite">
<div>I don't have routing issues with those IPs. ICMP is working
perfactly fine and hence server is reachable. </div>
<div><br>
</div>
<div>
<div><font face="monospace, monospace" size="1">anurag@server7:~$
ping -c 5 103.9.185.229</font></div>
<div><font face="monospace, monospace" size="1">PING
103.9.185.229 (103.9.185.229) 56(84) bytes of data.</font></div>
<div><font face="monospace, monospace" size="1">64 bytes from <a
moz-do-not-send="true" href="http://103.9.185.229">103.9.185.229</a>:
icmp_seq=1 ttl=55 time=209 ms</font></div>
<div><font face="monospace, monospace" size="1">64 bytes from <a
moz-do-not-send="true" href="http://103.9.185.229">103.9.185.229</a>:
icmp_seq=2 ttl=55 time=209 ms</font></div>
<div><font face="monospace, monospace" size="1">64 bytes from <a
moz-do-not-send="true" href="http://103.9.185.229">103.9.185.229</a>:
icmp_seq=3 ttl=55 time=209 ms</font></div>
<div><font face="monospace, monospace" size="1">64 bytes from <a
moz-do-not-send="true" href="http://103.9.185.229">103.9.185.229</a>:
icmp_seq=4 ttl=55 time=209 ms</font></div>
<div><font face="monospace, monospace" size="1">64 bytes from <a
moz-do-not-send="true" href="http://103.9.185.229">103.9.185.229</a>:
icmp_seq=5 ttl=55 time=209 ms</font></div>
<div><font face="monospace, monospace" size="1"><br>
</font></div>
<div><font face="monospace, monospace" size="1">---
103.9.185.229 ping statistics ---</font></div>
<div><font face="monospace, monospace" size="1">5 packets
transmitted, 5 received, 0% packet loss, time 4007ms</font></div>
<div><font face="monospace, monospace" size="1">rtt
min/avg/max/mdev = 209.578/209.646/209.734/0.056 ms</font></div>
<div><font face="monospace, monospace" size="1"><br>
</font></div>
</div>
</blockquote>
But you're saying you can't get DNS responses when querying from
server7, right?<br>
<br>
# on server7<br>
dig @183.9.185.229 btraccl.net mx<br>
# no reply?<br>
<br>
OK, then unless someone is spoofing ICMP echo, then either:<br>
* there is some filtering going on somewhere<br>
* your nameserver isn't answering queries from certain addresses
(unlikely but possible).<br>
<br>
I suggest running tcpdump on your nameserver as suggested before:<br>
<br>
tcpdump -i eth0 -nn -s0 -v host <server7 IP><br>
<br>
and repeat the query from server7. This will demonstrate whether the
filtering is of the inbound packets. Incidentally, try also the ping
from server7 and check this tcpdump sees the inbound icmp echo
requests and outbound icmp echo replies. (It's not entirely
impossible that some firewall somewhere is spoofing the icmp)<br>
<br>
So the scenarios you might have are:<br>
- no packet arrives<br>
- the packet arrives, but no response is sent<br>
- the packet arrives and response is sent (but the response doesn't
reach the client)<br>
<br>
If udp port 53 packets aren't arriving at the server, then they are
being filtered somewhere. Certainly some ISPs do filter UDP port 53
and/or UDP port 123; this is because their customers have been known
to participate in DNS reflection and/or NTP reflection attacks. If
you can prove your ISP is doing this, then they can fix it for you.
If it only happens to certain parts of the Internet then it could be
the filtering is taking place on one of their upstreams but not the
other. (*)<br>
<br>
If you have root on server7, then try this:<br>
<br>
# in one window<br>
sudo tcpdump -i eth0 -nn -s0 -v host 103.9.185.229 or icmp<br>
# in another window<br>
dig @103.9.185.229 btraccl.net mx<br>
<br>
If you are lucky, you may see an "ICMP Admin Prohibited" message
coming back from somewhere. If you do, the source address of this
packet will tell you which router is blocking the packet.<br>
<br>
Regards,<br>
<br>
Brian.<br>
<br>
(*) Looking on route-views.oregon-ix.net, I see that AS58616 appears
to have two upstreams: AS58587 and AS132602. That agrees with this:<br>
<a class="moz-txt-link-freetext" href="http://bgp.he.net/AS58616#_graph4">http://bgp.he.net/AS58616#_graph4</a><br>
<br>
Traceroutes from affected and unaffected parts of the Internet may
give you some clues as to which AS's the packets are passing
through.<br>
<br>
<br>
<br>
</body>
</html>