Attack! (Jun 29 2009)


log in

Advanced search

Message boards : Technical News : Attack! (Jun 29 2009)

Author Message
Profile Matt Lebofsky
Volunteer moderator
Project administrator
Project developer
Project scientist
Avatar
Send message
Joined: 1 Mar 99
Posts: 1389
Credit: 74,079
RAC: 0
United States
Message 912725 - Posted: 29 Jun 2009, 22:16:48 UTC

Another wacky weekend. Sounds like we were sending out a bunch of short workunits, which strains our bandwidth resources. Plus uploads were clogged for a while. The server was too busy and dropping connections, so the uploads weren't even reaching the server. On Saturday morning I did some TCP tweaking and seemed to clear up that log jam for the time being.

This morning it came to my attention that we've been sending out workunits with the "application/x-troff-man" mime type. This was because files with numerical suffices (like workunits) are assumed to be man pages. This may have been causing some blockages at firewalls. I changed the mime type to "text
/plain."

The SERENDIP web page was updated for the first time in many years. There's a link on the front page about that.

We plan to get the public NTPCkr candidate lists on line this week, ready or not. Trying to squeeze a couple more features in at the last minute, but I'm sure there will be bugs to work out and more features to add later on.

- Matt

____________
-- BOINC/SETI@home network/web/science/development person
-- "Any idiot can have a good idea. What is hard is to do it." - Jeanne-Claude

ClaggyProject donor
Volunteer tester
Send message
Joined: 5 Jul 99
Posts: 4058
Credit: 32,803,179
RAC: 5,177
United Kingdom
Message 912732 - Posted: 29 Jun 2009, 23:01:09 UTC - in response to Message 912725.

Thanks for the update Matt.

Claggy

Profile Johnney Guinness
Volunteer tester
Avatar
Send message
Joined: 11 Sep 06
Posts: 3091
Credit: 2,463,586
RAC: 2,495
Ireland
Message 912742 - Posted: 29 Jun 2009, 23:40:17 UTC - in response to Message 912725.
Last modified: 29 Jun 2009, 23:42:05 UTC

The SERENDIP web page was updated for the first time in many years. There's a link on the front page about that.

We plan to get the public NTPCkr candidate lists on line this week, ready or not. Trying to squeeze a couple more features in at the last minute, but I'm sure there will be bugs to work out and more features to add later on.

Matt that's 2 pieces of really good news, its very exciting! Really looking forward to the NitPicker. If there are bugs, we will try not to Nit-Pick too much. We'll go easy on you..LOL

Its very exciting, thank you for the work you put into this! SERENDIP website is cool!

John.
____________

CryptokiD
Avatar
Send message
Joined: 2 Dec 00
Posts: 134
Credit: 2,814,936
RAC: 0
United States
Message 912790 - Posted: 30 Jun 2009, 3:12:21 UTC - in response to Message 912725.

Sounds great and thanks for the work you put in. I did get a bunch of small work units. the small ones are 5-15 minutes. normal mb's are 45m-2 hours. I crunch them all anyways.

Profile [AF>france>pas-de-calais]symaski62
Volunteer tester
Send message
Joined: 12 Aug 05
Posts: 258
Credit: 100,444
RAC: 79
France
Message 912815 - Posted: 30 Jun 2009, 5:10:23 UTC

TY :)

je sais
____________
SETI@Home Informational message -9 result_overflow
with a general handicap of 80% and it makes much d' efforts for the community and s' expimer, thank you d' to be understanding.

Profile Dr. C.E.T.I.
Avatar
Send message
Joined: 29 Feb 00
Posts: 15993
Credit: 690,597
RAC: 1
United States
Message 912823 - Posted: 30 Jun 2009, 5:30:18 UTC

Thanks for the Updates Matt - nice work all-around Berkeley . . .
____________
BOINC Wiki . . .

Science Status Page . . .

Profile [AF>france>pas-de-calais]symaski62
Volunteer tester
Send message
Joined: 12 Aug 05
Posts: 258
Credit: 100,444
RAC: 79
France
Message 914104 - Posted: 4 Jul 2009, 22:18:27 UTC

hi ! :)

http://setiathome.ssl.berkeley.edu/mx/

sympa :)
____________
SETI@Home Informational message -9 result_overflow
with a general handicap of 80% and it makes much d' efforts for the community and s' expimer, thank you d' to be understanding.

Profile Constantin Razvan
Send message
Joined: 2 Oct 01
Posts: 7
Credit: 5,789,931
RAC: 8,206
Romania
Message 914363 - Posted: 5 Jul 2009, 16:19:54 UTC

Hope this is the right place to post
Our Zyxel router is blocking some connections from 208.68.240.18, residing on your network, for the following reason:

3 2009-07-05 16:27:43 warn IDP from Any to DMZ, [type=Sig(8002891)] WEB-CLIENT multipacket CHM file transfer attempt Action: Drop Packet Severity: medium 208.68.240.18:80 80.96.218.202:4137 ACCESS BLOCK

This is a recurring action, (almost 40 in 1 week)

The page with description from Zyxel:
https://mysecurity.zyxel.com/mysecurity/jsp/policy/policy_detail.jsp?TYPEID=8002891



____________

DrFoo
Send message
Joined: 17 Jul 99
Posts: 26
Credit: 23,655,191
RAC: 25,658
United States
Message 916137 - Posted: 9 Jul 2009, 12:50:49 UTC - in response to Message 914363.

Deepcuts:

That router is apparently using Snort as that's one of their rules. In general, that's a good thing. My guess is that BOINC is trying to download something (either an update or more likely just a specific workunit/task) that is inadvertently tripping this particular snort rule. It's what's called a false positive.

Check your transfers and messages tabs in the BOINC manager (you'll need to click the Advanced View link at the bottom of the little BOINC applet first if you haven't already). If I'm right, you'll probably see where it's been trying to download a file over and over again and it keeps failing. If it's just a workunit, you should see it listed with a status of downloading under the tasks tab. Just select that task and click the abort button. That should fix your problem.

I've scouted around a bit and so far I haven't seen any mention of this sort of thing elsewhere, so I doubt it's a fundamental problem. Chances are you were just unlucky enough to be assigned a workunit snort doesn't like.

Please let me know how it works out. If it's not just a particular workunit, or it happens again, someone should probably dig a bit deeper and see if there's a way to work with the Snort guys to solve the problem permanently. I'm not an expert on Snort or anything, but I'd be happy to help if nobody better qualified steps up.

Good luck!
____________

Profile Constantin Razvan
Send message
Joined: 2 Oct 01
Posts: 7
Credit: 5,789,931
RAC: 8,206
Romania
Message 916400 - Posted: 10 Jul 2009, 2:34:50 UTC
Last modified: 10 Jul 2009, 2:36:57 UTC

Indeed, work units are not downloaded anymore.
It might be a false positive, but then again it might not.

I posted this problem so the people who program BOINC can take action (with BOINC or Zyxel).

Have a nice weekend
____________

Nicolas
Avatar
Send message
Joined: 30 Mar 05
Posts: 160
Credit: 10,335
RAC: 0
Argentina
Message 918287 - Posted: 15 Jul 2009, 23:55:30 UTC - in response to Message 912725.
Last modified: 15 Jul 2009, 23:55:42 UTC

I changed the mime type to "text/plain."

But is it human-readable text? I don't think so...
____________

Contribute to the Wiki!

Message boards : Technical News : Attack! (Jun 29 2009)

Copyright © 2014 University of California