Network troubleshooting, any experts?

[Nigel Wade]

Elam Daly wrote:
> Jeff Vian wrote:
> 
>> \My thoughts are that they probably know this is a server, and as such 
>> may have blocked TCP from that particular host IP address.
>>
>>
>> It appears UDP and ICMP are getting through.
>>
>>>
>>
>>
> They do know it's a web server, as they host our website.  If TCP is 
> being blocked though, how is it possible that can people visit the
> website?  I realize that http connections come in through port 80, but 
> the responses from the webserver don't.  They leave from the
> webserver through any port that apache deems neccessary, correct?
> Elam Daly
> Whiteware Inc.
> 
> 

Without further info it's hard to say. The output of tcpdump is very cryptic 
and hard to read, it's not even differentiating between TCP and UDP. Do you 
have ethereal or tethereal installed, it's much, much beter.

The final 3 packets to p5.www.dcn.yahoo.com.http don't show any responses, 
and look like retransmissions. My guess would be that the firewall has been 
setup to block all incoming TCP traffic to any port other than port 80. If 
the firewall isn't stateful that would block all responses to outgoing TCP 
connections.

-- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
             University of Leicester, Leicester, LE1 7RH, UK
E-mail :    nmw at ion.le.ac.uk
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555