Topic: Strange... Can and then can't access one particular site...

[scismondo]

Hi all,

I have a very strange problem... I don't know if it comes from my server's default components or from Snort so I post it here.

Since yesterday I have problems accessing moneymakergroup.com. What is very strange is that:

- Right after the server has finished starting, I can load the site for a few minutes;
- Then it won't load anymore. The connection just times out after several minutes.
- The DNS resolution seems to work, a ping on the site from the server gives me the right IP but no reply from the site.
- A ping from one of my workstations works fine??????????
- There are some errors in Snort's logs with the site's IP:

Code: [Select]

[Classification: Misc activity] [Priority: 3]
07/19-12:48:25.209702 82.250.232.2 -> 72.32.7.54
ICMP TTL:64 TOS:0x0 ID:4 IpLen:20 DgmLen:84 DF
Type:8  Code:0  ID:48654   Seq:4  ECHO
[Xref => http://www.whitehats.com/info/IDS152]
... but stoping the snortd service doesn't give any result.
- If I restart the server I'll be able to load it again for a few minutes... Then something that I don't understand happens and... Boom. No more access.

Does anyone here has seen this before?

Thanks,

Seb.

edit: btw, it happened just after doing an update with Yum and then doing signal-event post-upgrade and signal-event reboot.

edit #2: I forgot to say... I'm using SME-Server 7, started from beta 2 and updated regularly.