Weird Ping - Mandriva

This is a discussion on Weird Ping - Mandriva ; I just pinged an .org address, and look at what I got: ==== [blinky@thurston ~]$ ping erwm.org PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data. --- erwm.org.blinkynet.net ping statistics --- 13 packets transmitted, 0 received, 100% packet loss, time 11996ms ==== ...

+ Reply to Thread
Results 1 to 17 of 17

Thread: Weird Ping

  1. Weird Ping

    I just pinged an .org address, and look at what I got:

    ====

    [blinky@thurston ~]$ ping erwm.org
    PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.

    --- erwm.org.blinkynet.net ping statistics ---
    13 packets transmitted, 0 received, 100% packet loss, time 11996ms

    ====

    Why the heck would ping append *my* domain to the one I requested?

    I immediately pinged another domain and that worked as usual.

    Note that erwm.org was not found, but I don't recall failures behaving
    that way before.

    I just retried the .org ping to see if this was consistent and got the
    same result. Was I just sleeping through this kind of response in the
    past?

    Mandriva 2006 Linux; kernel 2.6.12


    --
    Blinky RLU 297263
    Killing all posts from Google Groups
    The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html

  2. Re: Weird Ping

    On 3 Jul 2007 06:20:58 GMT, Blinky the Shark wrote:
    > I just pinged an .org address, and look at what I got:
    >
    > ====
    >
    > [blinky@thurston ~]$ ping erwm.org
    > PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.
    >
    > --- erwm.org.blinkynet.net ping statistics ---
    > 13 packets transmitted, 0 received, 100% packet loss, time 11996ms
    >
    > ====
    >
    > Why the heck would ping append *my* domain to the one I requested?


    something is realy dinked up somewhere.

    $ host 209.86.66.94
    94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.

    $ whois 209.86.66.94

    OrgName: EarthLink, Inc.
    OrgID: ERMS
    Address: 1375 PEACHTREE ST, LEVEL A
    City: ATLANTA
    StateProv: GA
    PostalCode: 30309
    Country: US

    NetRange: 209.86.0.0 - 209.86.255.255
    CIDR: 209.86.0.0/16
    NetName: EARTHLINK2000-E

  3. Re: Weird Ping

    Bit Twister wrote:
    > On 3 Jul 2007 06:20:58 GMT, Blinky the Shark wrote:
    >> I just pinged an .org address, and look at what I got:
    >>
    >> ====
    >>
    >> [blinky@thurston ~]$ ping erwm.org
    >> PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.
    >>
    >> --- erwm.org.blinkynet.net ping statistics ---
    >> 13 packets transmitted, 0 received, 100% packet loss, time 11996ms
    >>
    >> ====
    >>
    >> Why the heck would ping append *my* domain to the one I requested?

    >
    > something is realy dinked up somewhere.


    That's what I was thinking.

    > $ host 209.86.66.94
    > 94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.
    >
    > $ whois 209.86.66.94
    >
    > OrgName: EarthLink, Inc.
    > OrgID: ERMS
    > Address: 1375 PEACHTREE ST, LEVEL A
    > City: ATLANTA
    > StateProv: GA
    > PostalCode: 30309
    > Country: US
    >
    > NetRange: 209.86.0.0 - 209.86.255.255
    > CIDR: 209.86.0.0/16
    > NetName: EARTHLINK2000-E


    FWIW, I'm using Earthlink.


    --
    Blinky RLU 297263
    Killing all posts from Google Groups
    The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html

  4. Re: Weird Ping

    Bit Twister wrote:

    > something is realy dinked up somewhere.
    >
    > $ host 209.86.66.94
    > 94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.
    >
    > $ whois 209.86.66.94
    >
    > OrgName: EarthLink, Inc.
    > OrgID: ERMS
    > Address: 1375 PEACHTREE ST, LEVEL A
    > City: ATLANTA
    > StateProv: GA
    > PostalCode: 30309
    > Country: US
    >
    > NetRange: 209.86.0.0 - 209.86.255.255
    > CIDR: 209.86.0.0/16
    > NetName: EARTHLINK2000-E

    =============================================
    I tried the above as well :
    [frank@localhost ~]$ host 209.86.66.94
    94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.

    [frank@localhost ~]$ whois 209.86.66.94
    bash: whois: command not found
    [frank@localhost ~]$

    Also there is no man whois

    How to invoke whois ?

    TIA

    Frank








  5. Re: Weird Ping

    Highland Ham wrote:
    > Bit Twister wrote:
    >
    >> something is realy dinked up somewhere.
    >>
    >> $ host 209.86.66.94
    >> 94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.
    >>
    >> $ whois 209.86.66.94
    >>
    >> OrgName: EarthLink, Inc. OrgID: ERMS
    >> Address: 1375 PEACHTREE ST, LEVEL A
    >> City: ATLANTA
    >> StateProv: GA
    >> PostalCode: 30309
    >> Country: US
    >>
    >> NetRange: 209.86.0.0 - 209.86.255.255 CIDR: 209.86.0.0/16
    >> NetName: EARTHLINK2000-E

    > =============================================
    > I tried the above as well :
    > [frank@localhost ~]$ host 209.86.66.94
    > 94.66.86.209.in-addr.arpa domain name pointer elydm.05.am.barefruit.com.
    >
    > [frank@localhost ~]$ whois 209.86.66.94
    > bash: whois: command not found
    > [frank@localhost ~]$
    >
    > Also there is no man whois
    >
    > How to invoke whois ?
    >
    > TIA
    >
    > Frank

    ===============================
    Forgot to say that I am using MDV 2007.1

    Frank

    >
    >
    >
    >
    >
    >
    >


  6. Re: Weird Ping

    On Tue, 03 Jul 2007 14:26:59 +0100, Highland Ham wrote:
    >
    > [frank@localhost ~]$ whois 209.86.66.94
    > bash: whois: command not found
    > [frank@localhost ~]$
    >
    > Also there is no man whois
    >
    > How to invoke whois ?


    Well, the answer to your _question_ is, a
    $ type whois
    whois is /usr/bin/whois

    would suggest that if /usr/bin is in your path,
    $ echo $PATH

    then doing a
    whois ip|name_here
    would invoke whois.

    Now, the answer to your /problem/ is, click up a terminal
    su - root

    urpmi --wget whois --auto
    exit

    whois 209.86.66.94

  7. Re: Weird Ping

    On 3 Jul 2007 08:17:39 GMT, Blinky the Shark wrote:

    > FWIW, I'm using Earthlink.


    Ok, now you can start diging servers to see who is lying to you. Example:

    dig yahoo.com @ip.addy
    ^ ^
    | |
    | `---------- dns server ip to dig with
    `---- name or ip to have server look up.

  8. Re: Weird Ping

    Bit Twister wrote:
    > On 3 Jul 2007 08:17:39 GMT, Blinky the Shark wrote:
    >
    >> FWIW, I'm using Earthlink.

    >
    > Ok, now you can start diging servers to see who is lying to you. Example:
    >
    > dig yahoo.com @ip.addy
    > ^ ^
    > | |
    > | `---------- dns server ip to dig with
    > `---- name or ip to have server look up.


    How do I determine what dns server to specify?

    FWIW, without that parameter, I got:



    [root@thurston blinky]# dig erwm.com

    ; <<>> DiG 9.3.1 <<>> erwm.com
    ;; global options: printcmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21508
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1

    ;; QUESTION SECTION:
    ;erwm.com. IN A

    ;; ANSWER SECTION:
    erwm.com. 43200 IN A 66.226.64.7

    ;; AUTHORITY SECTION:
    erwm.com. 43200 IN NS ns1.abac.com.
    erwm.com. 43200 IN NS ns2.abac.com.

    ;; ADDITIONAL SECTION:
    ns1.abac.com. 1666 IN A 216.55.128.4

    ;; Query time: 210 msec
    ;; SERVER: 207.69.188.187#53(207.69.188.187)
    ;; WHEN: Tue Jul 3 11:53:10 2007
    ;; MSG SIZE rcvd: 99



    --
    Blinky RLU 297263
    Killing all posts from Google Groups
    The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html

  9. Re: Weird Ping

    On 3 Jul 2007 18:56:17 GMT, Blinky the Shark wrote:
    > Bit Twister wrote:


    >> Ok, now you can start diging servers to see who is lying to you. Example:
    >>
    >> dig yahoo.com @ip.addy
    >> ^ ^
    >> | |
    >> | `---------- dns server ip to dig with
    >> `---- name or ip to have server look up.

    >
    > How do I determine what dns server to specify?


    Each server has it's dns server list. When the resolver can not find
    the item, it hands off the request to the next DNS.

    You have dns ip addresses in your /etc/resolv.conf.
    You might have them your router/firewall.
    Your ISP has local dns servers they tell customers to use.
    Your ISP has global dns servers anyone can use to find the ISP
    machines/customers

    Then dns resolutions go up the chain until it comes back down to the
    service provider who realy knows the target ip/FQDN. It returns the
    requested information back to you.


    >
    > FWIW, without that parameter, I got:
    >
    > [root@thurston blinky]# dig erwm.com


    >
    > ;; Query time: 210 msec
    > ;; SERVER: 207.69.188.187 <==== who responed with the answer


  10. Re: Weird Ping

    Bit Twister wrote:
    > On Tue, 03 Jul 2007 14:26:59 +0100, Highland Ham wrote:
    >> [frank@localhost ~]$ whois 209.86.66.94
    >> bash: whois: command not found
    >> [frank@localhost ~]$
    >>
    >> Also there is no man whois
    >>
    >> How to invoke whois ?

    >
    > Well, the answer to your _question_ is, a
    > $ type whois
    > whois is /usr/bin/whois
    >
    > would suggest that if /usr/bin is in your path,
    > $ echo $PATH
    >
    > then doing a
    > whois ip|name_here
    > would invoke whois.
    >
    > Now, the answer to your /problem/ is, click up a terminal
    > su - root
    >
    > urpmi --wget whois --auto
    > exit
    >
    > whois 209.86.66.94

    ================================
    Hi BT ,tnx a bunch , all ok now .........I am a slow learner .
    I often follow-up instructions re problems others have ;the above topic
    was one of those.

    Frank

  11. Re: Weird Ping

    On Tue, 03 Jul 2007 20:49:50 +0100, Highland Ham wrote:

    > I often follow-up instructions re problems others have


    Me too. I would much rather gain troubleshooting/linux experience
    troubleshooting problems on their machines rather than have to
    find/fix those problems on my machine. 8-)

  12. Re: Weird Ping

    On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in article
    , Blinky the Shark wrote:

    >I just pinged an .org address, and look at what I got:
    >
    >====
    >
    >[blinky@thurston ~]$ ping erwm.org
    >PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.
    >
    >--- erwm.org.blinkynet.net ping statistics ---
    >13 packets transmitted, 0 received, 100% packet loss, time 11996ms
    >
    >====
    >
    >Why the heck would ping append *my* domain to the one I requested?


    Long story - short answer is you told it to. Man resolver, and look at
    the "search" directive. (Also look at the "domain" directive, both of
    which can cause some really strange results as you show here.) Then
    fix your /etc/resolv.conf file as needed.

    >I immediately pinged another domain and that worked as usual.


    OK

    >Note that erwm.org was not found, but I don't recall failures behaving
    >that way before.


    The domain exists (registered a couple days ago), but the name server that's
    supposed to be authoratative isn't responding.

    Ah, and that exposes another problem somewhere.

    What happened is that your resolver tried to look up 'erwm.org', and got
    a NXDOMAIN answer from the name server you asked. Your resolver then
    followed your directions, and tried again asking about the original
    name EXPANDED with the results of the 'search' or 'domain' name. Now
    whoever is running the DNS for blinkynet.net may have a wild-card
    in the zonefile (if the name doesn't match anything, return "this"
    value) and somehow that answer came back as 209.86.66.94, which you
    then pinged (use the -c option to cut down the number of pings), and
    that host isn't responding to a ping.

    So, 1) fix the /etc/resolv.conf file, and 2) ask who ever is running
    the DNS server for 'blinkynet.net' WTF.

    >Was I just sleeping through this kind of response in the past?


    Hard to say - when did you change /etc/resolv.conf, and when did the
    zone file get mucked with? I just tried 'erwm.org.blinkynet.net'
    here, and the result is the proper NXDOMAIN, so maybe the wild card
    has been fixed.

    Old guy

  13. Re: Weird Ping

    Moe Trin wrote:

    > On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in
    > article , Blinky
    > the Shark wrote:
    >
    >>I just pinged an .org address, and look at what I got:
    >>
    >>====
    >>
    >>[blinky@thurston ~]$ ping erwm.org
    >>PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.
    >>
    >>--- erwm.org.blinkynet.net ping statistics ---
    >>13 packets transmitted, 0 received, 100% packet loss, time
    >>11996ms
    >>
    >>====
    >>
    >>Why the heck would ping append *my* domain to the one I
    >>requested?

    >
    > Long story - short answer is you told it to. Man resolver, and
    > look at the "search" directive. (Also look at the "domain"
    > directive, both of which can cause some really strange results
    > as you show here.) Then fix your /etc/resolv.conf file as
    > needed.
    >
    >>I immediately pinged another domain and that worked as usual.

    >
    > OK
    >
    >>Note that erwm.org was not found, but I don't recall failures
    >>behaving that way before.

    >
    > The domain exists (registered a couple days ago), but the name
    > server that's supposed to be authoratative isn't responding.
    >
    > Ah, and that exposes another problem somewhere.
    >
    > What happened is that your resolver tried to look up 'erwm.org',
    > and got a NXDOMAIN answer from the name server you asked. Your
    > resolver then followed your directions, and tried again asking
    > about the original name EXPANDED with the results of the
    > 'search' or 'domain' name. Now whoever is running the DNS for
    > blinkynet.net may have a wild-card in the zonefile (if the name
    > doesn't match anything, return "this" value) and somehow that
    > answer came back as 209.86.66.94, which you then pinged (use the


    *I* only pinged once. erwm.com

    > -c option to cut down the number of pings), and that host isn't
    > responding to a ping.
    >
    > So, 1) fix the /etc/resolv.conf file, and 2) ask who ever is
    > running the DNS server for 'blinkynet.net' WTF.


    By now, my head is just bleeding.

    I think I'll just hope it doesn't happen again.

    >>Was I just sleeping through this kind of response in the past?

    >
    > Hard to say - when did you change /etc/resolv.conf, and when did
    > the zone file get mucked with? I just tried
    > 'erwm.org.blinkynet.net' here, and the result is the proper
    > NXDOMAIN, so maybe the wild card has been fixed.


    I dunno. Maybe last year. When the OS was installed.

    --
    Blinky
    Killfiling all posts from Google Groups
    Details: http://blinkynet.net/comp/uip5.html

  14. Re: Weird Ping

    Moe Trin wrote:
    > On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in article
    > , Blinky the Shark wrote:
    >
    >> I just pinged an .org address, and look at what I got:
    >>
    >> ====
    >>
    >> [blinky@thurston ~]$ ping erwm.org
    >> PING erwm.org.blinkynet.net (209.86.66.94) 56(84) bytes of data.
    >>
    >> --- erwm.org.blinkynet.net ping statistics ---
    >> 13 packets transmitted, 0 received, 100% packet loss, time 11996ms
    >>
    >> ====
    >>
    >> Why the heck would ping append *my* domain to the one I requested?

    >
    > Long story - short answer is you told it to. Man resolver, and look at
    > the "search" directive. (Also look at the "domain" directive, both of
    > which can cause some really strange results as you show here.) Then
    > fix your /etc/resolv.conf file as needed.
    >
    >> I immediately pinged another domain and that worked as usual.

    >
    > OK
    >
    >> Note that erwm.org was not found, but I don't recall failures behaving
    >> that way before.

    >
    > The domain exists (registered a couple days ago), but the name server that's
    > supposed to be authoratative isn't responding.
    >
    > Ah, and that exposes another problem somewhere.
    >
    > What happened is that your resolver tried to look up 'erwm.org', and got
    > a NXDOMAIN answer from the name server you asked. Your resolver then
    > followed your directions, and tried again asking about the original
    > name EXPANDED with the results of the 'search' or 'domain' name. Now
    > whoever is running the DNS for blinkynet.net may have a wild-card
    > in the zonefile (if the name doesn't match anything, return "this"
    > value) and somehow that answer came back as 209.86.66.94, which you
    > then pinged (use the -c option to cut down the number of pings), and
    > that host isn't responding to a ping.
    >
    > So, 1) fix the /etc/resolv.conf file, and 2) ask who ever is running
    > the DNS server for 'blinkynet.net' WTF.
    >
    >> Was I just sleeping through this kind of response in the past?

    >
    > Hard to say - when did you change /etc/resolv.conf, and when did the
    > zone file get mucked with? I just tried 'erwm.org.blinkynet.net'
    > here, and the result is the proper NXDOMAIN, so maybe the wild card
    > has been fixed.
    >
    > Old guy


    In addition to the above, I note you tried ping erwm.org
    but later tried dig erwm.com. Different things entirely.

    [jim@jb geneal]$ ping erwm.org
    ping: unknown host erwm.org

    [jim@jb geneal]$ ping erwm.com
    PING erwm.com (66.226.64.7) 56(84) bytes of data.
    64 bytes from pro6.abac.com (66.226.64.7): icmp_seq=1 ttl=50 time=76.9 ms
    64 bytes from pro6.abac.com (66.226.64.7): icmp_seq=2 ttl=50 time=77.3 ms
    --- erwm.com ping statistics ---
    2 packets transmitted, 2 received, 0% packet loss, time 1002ms
    rtt min/avg/max/mdev = 76.980/77.185/77.390/0.205 ms

    erwm.org is registered, but seems not to be in operation.

    Domain ID148209117-LROR
    Domain Name:ERWM.ORG
    Created On:23-Jun-2007 01:49:58 UTC
    Last Updated On:23-Jun-2007 01:53:23 UTC
    Expiration Date:23-Jun-2008 01:49:58 UTC
    Sponsoring Registrar:Go Daddy Software, Inc. (R91-LROR)


    Cheers!

    jim b.

    --
    UNIX is not user-unfriendly; it merely
    expects users to be computer-friendly.

  15. Re: Weird Ping

    On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in article
    , Blinky the Shark wrote:

    >Moe Trin wrote:


    >> Blinky the Shark wrote:


    >>>Why the heck would ping append *my* domain to the one I
    >>>requested?


    Actually, it wasn't ping - it was the resolver code in the kernel

    >> Long story - short answer is you told it to. Man resolver, and
    >> look at the "search" directive. (Also look at the "domain"
    >> directive, both of which can cause some really strange results
    >> as you show here.) Then fix your /etc/resolv.conf file as
    >> needed.


    This is also an example of the security problem that the two multicast
    DNS (microsoft got RFC4795 adopted as an INFORMATIONAL RFC, but an
    incompatible competing version from Apple - included in some Linux
    distributions as "Avahi") opens up for. You ask for the address of
    your_bank.com while unable to reach a name server, Avahi then trys
    a multicast DNS query for your_bank.com.the_domain_in_the_search.line)
    and some cracker's box responds with "that.is.my.address" and they
    may now have your username and pass-code. Not a good deal.

    >> What happened is that your resolver tried to look up 'erwm.org',
    >> and got a NXDOMAIN answer from the name server you asked.


    or more likely, no response at all

    >> Your resolver then followed your directions, and tried again asking
    >> about the original name EXPANDED with the results of the
    >> 'search' or 'domain' name.


    As I said - security problem.

    >*I* only pinged once. erwm.com


    You write 'erwm.com' here, but your original post showed erwm.org.
    Two different domains. One is in New York (.com) and the other in
    Texas (.org).

    >> -c option to cut down the number of pings), and that host isn't
    >> responding to a ping.


    Minor sore point with me. If it doesn't answer three pings (-c 3), it
    probably isn't going to answer in a hundred. Three is _usually_ enough
    to establish that the connection works - anything more might be
    considered abuse.

    >> 2) ask who ever is running the DNS server for 'blinkynet.net' WTF.


    >By now, my head is just bleeding.


    Are you the owner of the DNS zonefiles, or is downtownhost.com the
    responsible party? A "wildcard" entry in the zonefile itself would
    be a star, or "*.blinkynet.net" pointing at a single address. I don't
    see it mentioned in the DNS-HOWTO, but it's mentioned in the "Cricket
    Book" ("DNS and BIND" from O'Reilly).

    >I think I'll just hope it doesn't happen again.


    Quick check - does a DNS query for "totally.unknown.host.blinkynet.net"
    or "totally.bogus.hostname.blinkynet.net" return anything other that
    "sorry, no cigar"? If it replies with an IP address, you have a
    wildcard problem - if it doesn't, you're fine.

    Old guy


  16. Re: Weird Ping

    Moe Trin wrote:

    > On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in
    > article , Blinky
    > the Shark wrote:
    >>I think I'll just hope it doesn't happen again.


    > Quick check - does a DNS query for
    > "totally.unknown.host.blinkynet.net" or
    > "totally.bogus.hostname.blinkynet.net" return anything other
    > that "sorry, no cigar"? If it replies with an IP address, you
    > have a wildcard problem - if it doesn't, you're fine.


    I'm on the road, and won't be using that system or OS for a few
    days.

    --
    Blinky
    Killfiling all posts from Google Groups
    Details: http://blinkynet.net/comp/uip5.html

  17. Re: Weird Ping

    On 3 Jul 2007, in the Usenet newsgroup alt.os.linux.mandriva, in article
    , Blinky the Shark wrote:

    >How do I determine what dns server to specify?


    If you don't specify a DNS server, these query tools (dig, dnsquery,
    host, nslookup) use one of the name server listed in /etc/resolv.conf.
    However to find the "authoritative" name servers, there are several
    ways. First is to use a whois query to get the information from the
    appropriate registrar. In the case of "erwm.com', the initial whois
    query of Notwork Solutions points me to whois.names4ever.com, and
    asking them yields (among other things):

    Domain servers in listed order:
    ns1.abac.com 216.55.128.4
    ns2.abac.com

    (looks like names4ever.com doesn't know the IP of the second server).
    A problem here is that Notwork Solutions only knows about a few top
    level domains. Finding others can be fun, as there is no standard to
    the name schemes - whois.dns.be, whois.cat, whois.nic.ch, whois.nic.cz,
    whois.denic.de, whois.dk-hostmaster.dk, whois.nic.fr... at least MOST
    of them begin with "whois.something" but this is not true for everyone.

    Another solution, which USUALLY works is to query using your nameserver
    to find all (or at least the NS records) for the domain.

    [compton ~]$ host -t NS erwm.com
    erwm.com name server ns1.abac.com
    erwm.com name server ns2.abac.com
    [compton ~]$

    I'm using 'host' but all of these tools have the identical function
    (man page says 'dig' wants 'dig erwm.com ns' - sounds good to me).

    >[root@thurston blinky]# dig erwm.com


    >;; AUTHORITY SECTION:
    >erwm.com. 43200 IN NS ns1.abac.com.
    >erwm.com. 43200 IN NS ns2.abac.com.
    >
    >;; ADDITIONAL SECTION:
    >ns1.abac.com. 1666 IN A 216.55.128.4


    and there is the answer as well.

    Old guy

+ Reply to Thread