UDP port closed in an http request

UDP port closed in an http request

[Lionel Duboeuf]

Dear all,

Trying to explain my problem:
I've Linux Mandrake 8.0

I use iptables for filtering but this problem still exist with transforming
my linux box in a client of a network:

i can ping 193.252.19.189 but not www.wanadoo.fr
i can dig or nslookup www.wanadoo.fr which reports me 193.252.19.189
of course while i'm doing http://193.252.19.189 everythings works fine but
http://www.wanadoo.fr not.

my nameservers are OK ( 193.252.19.3 and .4 in resolv.conf)

I dumped the tcpdump result which give me a udp port unreachable:
(FJT hostname of my linuxbox, 192.168.01 is my gateway)

09:59:18.882158 FJT.32859 > 193.252.19.3.domain: 32456+ A? www.wanadoo.fr.
(32) (DF)

09:59:18.883391 FJT.32860 > 193.252.19.3.domain: 30805+ PTR?
3.19.252.193.in-addr.arpa. (43) (DF)

09:59:18.945537 192.168.0.1.domain > FJT.32859: 32456* 1/2/2 A
193.252.19.189 (115) (DF)

09:59:18.945582 FJT > 192.168.0.1: icmp: FJT udp port 32859 unreachable (DF)
[tos 0xc0]

09:59:18.949660 192.168.0.1.domain > FJT.32860: 30805* 1/2/2 (138) (DF)

09:59:18.949678 FJT > 192.168.0.1: icmp: FJT udp port 32860 unreachable (DF)
[tos 0xc0]

09:59:23.878466 arp who-has 192.168.0.1 tell FJT

09:59:23.878693 arp reply 192.168.0.1 is-at 0:a0:65:b5:71:5e


any help would be very nice.
Thanks a lot

Lionel Duboeuf

Re: UDP port closed in an http request

[Sascha Reissner]

From: "Lionel Duboeuf" <lionel.duboeuf@adpsa12.org>

> i can ping 193.252.19.189 but not www.wanadoo.fr
> i can dig or nslookup www.wanadoo.fr which reports me 193.252.19.189
> of course while i'm doing http://193.252.19.189 everythings works fine but
> http://www.wanadoo.fr not.

enigma@gate:/home/enigma > dig www.wanadoo.fr

;; ANSWER SECTION:
www.wanadoo.fr.         86400   IN      A       193.252.19.142

and i can't ping neither the fqdn nor the ip...

enigma@gate:/home/enigma > telnet www.wanadoo.fr 80
Trying 193.252.19.142...
Connected to www.wanadoo.fr.
Escape character is '^]'.
GET / HTTP/1.1
Host: www.wanadoo.fr

HTTP/1.1 200 OK

works like charm here..

maybe got a poisoned ns, or something strange in your hosts file?