Web Hosting Talk







View Full Version : Ack - my RS IP address has been hijacked


nudetravel
06-24-2002, 01:43 PM
Hey all - submitted this trouble ticket to Rackshack at 9:00am this morning -

===========
My site http://www.nudetravelguide.com on IP 216.127.68.145 is bringing up the placeholder for http://music182account.com/. This is the case when I try to address my site through the name or IP. This IP was assigned to me on a ticket May 23 .


Whois shows no information for music182account.com. I have verified all DNS entries for my site nudetravelguide.com. I use register.com DNS servers.

Please resolve this very quickly - this is a mission critical site and I cant afford for the search engines to crawl it with the placeholder page coming up. Judging from my hitbox stats, this problems has been occurring since Wednesday the 19th.

==========

That is not my servers primary IP and all of my other sites are working. I assume that means that RS has inadvertently re-routed my IP to another server?

I called RS at 12:30pm and asked them to please take a look at the trouble ticket...they assured me they would get to it ASAP.

Man I hope googlebot doesn't come crawling....I have one of those monitor services that pings the server and pages me when it is down, but since it never really went offline I didn't get the alarm!

clocker1996
06-24-2002, 02:13 PM
join the club
happend to me too
they told me to contact the person and get it resolved

yea imgonna email them

"plz stop using my ips"

porcupine
06-24-2002, 02:15 PM
Hrm, give them a verbal thrashing clocker :D.

nudetravel
06-24-2002, 02:28 PM
What a drag clocker. What was the final resolution?

I would be happy to contact the person but there is no whois for the domain!! Anyways, how can someone use my IP? As long as the router points it to MY server, them setting UP DNS records, etc, wouldn't matter would it?

Doesn't this HAVE to be a router issue?

clocker1996
06-24-2002, 02:52 PM
they just bind the ip to their machine

and the guy ended up taking it off

Patrick-EV1
06-24-2002, 03:21 PM
I removed the IPs from the offending server and have given the other user a warning. clocker1996 - I cant imagine why they would ask you to contact the other user, this is our responsibility. I apologize for that. Just a follow up to let everyone know his issue was resolved.

nudetravel
06-24-2002, 03:29 PM
Patrick, thanks - I am indeed back in business on that site.
(This wasn't a "complain about Rackshack" thread, but a "how can this happen" thread.)

Clocker Said:
they just bind the ip to their machine

I don't get it? How do you bind an IP to your machine if the router is pointing it elsewhere? Can I ask for a newbie-level explanation?

It seems that this would be an easy way to shut down a competitors site doesn't it? hmmm.......

porcupine
06-24-2002, 03:33 PM
Originally posted by nudetravel
Patrick, thanks - I am indeed back in business on that site.
(This wasn't a "complain about Rackshack" thread, but a "how can this happen" thread.)

Clocker Said:


I don't get it? How do you bind an IP to your machine if the router is pointing it elsewhere? Can I ask for a newbie-level explanation?

It seems that this would be an easy way to shut down a competitors site doesn't it? hmmm.......

It's only assigned at router level if you're setup using private vlan's. A lot of places dont like to do this because it's extremely labour intensive, and wastes 3 ip's per vlan (and if you're putting ppl in 4 or 8 ip blocks, that leaves the user with 1, or 5 ip's, almost 50% waste. Typically it's a very low problem occurance as you can't bind an ip thats taken elsewhere usually, and very few users would compromise their services and risk termination to save $1-2 and steal an ip without permission.

clocker1996
06-24-2002, 03:51 PM
Originally posted by Patrick-EV1
I removed the IPs from the offending server and have given the other user a warning. clocker1996 - I cant imagine why they would ask you to contact the other user, this is our responsibility. I apologize for that. Just a follow up to let everyone know his issue was resolved.

nah its cool dude
it was before i met you
and from my experiences you are the most reliable person at rackshack

patrick is someone who you can really count on, and is very helpful, and i thank him for everythign hes done for me :)

but yeah
I don't know why they told me to contact the person either...

oh well, past is past.

cabalstudios
06-24-2002, 05:21 PM
Just the one thing....

HAVE YOU HEARD OF VLAN ?????? :eek: :eek: :eek:

porcupine
06-24-2002, 05:30 PM
Originally posted by cabalstudios
Just the one thing....

HAVE YOU HEARD OF VLAN ?????? :eek: :eek: :eek:

... Considering they have over 6000 servers, majority with < 4 ip addresses, that would mean between 40-70% IP address waste and a whole lot of waste.

:eek: :eek2: I dont think it'd work :)

cabalstudios
06-24-2002, 05:45 PM
Originally posted by porcupine


... Considering they have over 6000 servers, majority with < 4 ip addresses, that would mean between 40-70% IP address waste and a whole lot of waste.

:eek: :eek2: I dont think it'd work :)

That cannot be an excuse, your saying there are no hosts bigger than EV1 that do not use VLAN..

On a side note :D It has more benifts than that are ovious to the end user i.e. ability to assign more than 1 subnet to a server, something users find out when they request more ips and get told that they need to have the server moved to be able to get more ip address.

If this had been any other host i would have said the same, VLAN is the way to go, for privacy and security of customers.

That's my opinion and i will stick by it.

mdrussell
06-24-2002, 05:58 PM
Originally posted by cabalstudios


That cannot be an excuse, your saying there are no hosts bigger than EV1 that do not use VLAN..

On a side note :D It has more benifts than that are ovious to the end user i.e. ability to assign more than 1 subnet to a server, something users find out when they request more ips and get told that they need to have the server moved to be able to get more ip address.

If this had been any other host i would have said the same, VLAN is the way to go, for privacy and security of customers.

That's my opinion and i will stick by it.

I certainly would be interested to see if larger providers than RS, (and there aren't many larger) uses VLANs. I don't think Arin would be too impressed if that many IPs were, in effect, being wasted.

porcupine
06-24-2002, 06:29 PM
Well, VLAN's are great and all in a high abuse network, like a shell network where you got hacking kiddies every 2 servers trying to scan around, because it can add some privacy (considering you can make each vlan private to the others), but in a low abuse sitiuation like i'd imagine rackshack has (per capita), VLAN would be a VERY labour intensive way to do things, and would jack up the bottom line costs by a LOT!. I'm not saying larger providers dont use them, im just saying, they allocate 1 ip address per server, thats a /30 (4 ip addresses) per block, and that leaves 1 for the server, 1 for network, 1 for gateway, and 1 for broadcast, having 75% of the ip addresses basically wasted. Personally, in allocations of 32+ i would totally be using VLAN's, but for < 10 ip addresses, its just such a waste if your abuse ratio's are low.

And Matt, ARIN might not like it, but VLAN's are the official way of doing it last i checked and covered in the RFC's, so they probably would just take the kick in the pants and maybe take away a /8 from nasa or something like that (theres a few organizations that have a /8 (1/255) of the worlds assignable ip addresses last i checked, and they use virtually none of them).

Thats just my $0.02 of course :D

panopticon
06-24-2002, 06:31 PM
I wonder how Arin would feel if their own web servers were rendered inoperable by someone else at their data center stealing the IP addresses they're using for their own web sites :D

porcupine
06-24-2002, 06:41 PM
lol :D. I'm sure the guys at ARIN would have no problem dealing with that within a matter of minutes, maybe remove all the routes to that Data Center or what have you :D.

nudetravel
06-25-2002, 10:00 AM
Arin and Vlans not withstanding, when you refer to "binding" an IP to your server, what are you referring to? I would assume that by having my machine set up for a site on that IP number I would have it bound to my server so that someone like this moron can't use it.

Why did his site come up instead of mine, when my domain has DNS and zone records, and his didn't even exist?

Is there something I need to do to protect my IP based sites?

Also - I guess RS keeps a pretty close eye on these forums - I was surprised that Patrick posted something here about my problem - they must want to head off any public complaining :-)

I am not dissatisfied with the service I received on this - about 4hrs after I notified them via trouble ticket, and when I spoke to tech they said the matter had be "escalated" to a senior so that they could get into the other guys box and take off my IP address.

prime
06-25-2002, 10:23 AM
Arin and Vlans not withstanding, when you refer to "binding" an IP to your server, what are you referring to?
Well, linux allows you to have more than one address (IP) on each lan card, so to steal your address I guess one would just have to start using it by telling ifconfig to use it.

Why did his site come up instead of mine, when my domain has DNS and zone records, and his didn't even exist?
Well, you had a DNS didn't you ;) ? A DNS only tells a browser (or whatever) what IP address to look up to get a site. From your access to your site, your IP for your site probably got in some cache somewhere, which is normal. The rest came from apache, but by then the surfers were already on his server and not yours. Apache comes with a kind of catchall configuration by default, so even when it was asked for a name it didn't recognize (your site) the request was handled by that catchall config and the surfer was sent to the page you saw.

As for why he was able to take the IP (ie, why his config was 'stronger' than yours), I'm not certain how it happens. Maybe he had less hops to the main link, or he rebooted after you which gave him the priority... I know that on Windows, a new computer coming on a net using an address already in use won't be allowed on. Maybe linux cuts off the 1st one :(.

Is there something I need to do to protect my IP based sites?
I don't think anything can be done, for reasons listed higher (waste of IPs, mostly).

Also - I guess RS keeps a pretty close eye on these forums
They do own & operate them ;)

Good luck