Tickets - deham01 seems to have problems with proto 41 :: SixXS

Ticket ID: SIXXS #1178843
Ticket Status: User

PoP: deham01 - Easynet (Hamburg)

deham01 seems to have problems with proto 41

Shadow Hawkins on Tuesday, 18 August 2009 20:44:13

Hi, since about 18:15 (German time, UTC+0100) deham01 does not forward any packets for my tunnel. Diagnosis so far: *tunnel ID 20389 *it worked at least till 3pm, according to my tunnel status it stopped 18:15 *my own router has definitely not changed today (Debian Lenny, last upgrade yesterday, it worked today) *I can ping deham01 on IPv4 *aiccu does not report any errors when starting up (neither on the console, nor in the syslog) - so TIC seems to work *the device is visible (ifconfig) *I can ping my side (tunnel::2), but not the POP side (tunnel::1) *routing table looks ok (important part created by aiccu, tcpdump on the DSL line shows me sending proto41 packets, so it can't be completely wrong) *firewall looks ok (did not change, IPv4 lets proto41 through, IPv6 allows ping etc.pp.) *from an IPv6 connected host outside my own net (a 6to4 host) I can ping deham01 on IPv6 and I can ping tunnel::1, but not tunnel::2 or any other host inside my network *tcpdump on my DSL-line (ppp0) shows lines like these when I ping any host on IPv6: 20:33:06.022991 IP 217.235.65.7 > 212.224.0.188: IP6 2001:6f8:900:c81::2 > 2002:d9a0:db4b::1: ICMP6, echo request, seq 8, length 64 20:33:06.079511 IP 212.224.0.188 > 217.235.65.7: ICMP 212.224.0.188 protocol 41 port 0 unreachable, length 132 20:34:17.243031 IP 217.235.65.7 > 212.224.0.188: IP6 2001:6f8:900:c81::2 > 2001:6f8:900:c81::1: ICMP6, echo request, seq 8, length 64 20:34:17.300303 IP 212.224.0.188 > 217.235.65.7: ICMP 212.224.0.188 protocol 41 port 0 unreachable, length 132 To me this looks like deham01 forgot how to handle proto41, could be that the SW is down or that the firefall is too up. ;-) regards, Konrad Rosenbaum

deham01: AYIYA down as well since 16:24 UTC

Shadow Hawkins on Tuesday, 18 August 2009 21:30:07

AYIYA stopped working at about 16:24 UTC (my IRC connection died at that time). UDP port 5072 is closed. aiccu test output: ###### [6/8] Ping the IPv6 Remote/PoP Inner Tunnel Endpoint (2001:6f8:900:16f::1) ### This confirms the reachability of the other side of the tunnel ### If it doesn't reply then check your interface and routing tables ### Don't forget to check your firewall of course ### If the previous test was succesful then this could be both ### a firewalling and a routing/interface problem PING 2001:6f8:900:16f::1(2001:6f8:900:16f::1) 56 data bytes --- 2001:6f8:900:16f::1 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2013ms tcpdump output: 21:23:58.863489 IP (tos 0x0, ttl 64, id 49233, offset 0, flags [DF], proto UDP (17), length 176) 10.196.136.41.37726 > 212.224.0.188.5072: [udp sum ok] UDP, length 148 21:23:58.886141 IP (tos 0x0, ttl 53, id 13415, offset 0, flags [none], proto ICMP (1), length 204) 212.224.0.188 > 10.196.136.41: ICMP 212.224.0.188 udp port 5072 unreachable, length 184 IP (tos 0x0, ttl 54, id 49233, offset 0, flags [DF], proto UDP (17), length 176) 10.196.136.41.37726 > 212.224.0.188.5072: [udp sum ok] UDP, length 148 User SS8-SIXXS, Tunnel T2475 The tunnel from my laptop to dedus01 (T21683) is working fine over the same outgoing interface meanwhile, so local setup and IPv4 upstream is OK.

State change: user Locked

Jeroen Massar SixXS Staff

on Wednesday, 19 August 2009 00:51:30

The state of this ticket has been changed to user

deham01 seems to have problems with proto 41

Jeroen Massar SixXS Staff

on Wednesday, 19 August 2009 00:52:53

20:33:06.079511 IP 212.224.0.188 > 217.235.65.7: ICMP 212.224.0.188 protocol

41 port 0 unreachable, length 132

Did you check that your clock is NTP synced, because when it is not, and/or there are no valid heartbeat packets received on the PoP, the tunnel won't be configured, and you will indeed receive the above.

deham01 seems to have problems with proto 41

Shadow Hawkins on Wednesday, 19 August 2009 06:23:40

Yes, all my machines are NTP synced all the time (and the clock certainly looked in sync with my DCF-watch at the time in question). It works again in the meantime, so ticket can be closed. Just out of curiosity: does anyone know what was wrong?

Please note Posting is only allowed when you are logged in.