Hello,
There is no other firewall on the local server, I have tried from multiple
locations all with the same result, that's with firewalls flushed on both
the incoming and outgoing servers.
There has to be a firewall somewhere that is not on these servers, such as a
hardware one which is why this ticket has been raised, the connections to the
port are not even being seen.
Here is some examples from 209.85.41.69, where I ping which works fine, I test
snmp(port 161) it doesn't show anything, I test port 80 works fine, I test
a random port which does not exist which does show the packet.
It is only the port 161 which is not being shown at all, even with snmpd
stopped it still does never hit the server.
root@host2 [~]# tcpdump src 209.85.41.69 tcpdump: verbose output suppressed,
use -v or -vv for full protocol decode listening on eth0, link-type EN10MB
(Ethernet), capture size 96 bytes 13:13:17.946814 IP web1.impulsecorp.com >
host2.bikeforums.net: icmp 64: echo request seq 0 13:13:18.929920 IP
web1.impulsecorp.com > host2.bikeforums.net: icmp 64: echo request seq 1
13:13:19.950875 IP web1.impulsecorp.com > host2.bikeforums.net: icmp 64:
echo request seq 2 13:14:42.896440 IP web1.impulsecorp.com.34824 >
host2.bikeforums.net.http: S 1508364993:1508364993(0) win 5840 <mss
1460> 13:14:42.938183 IP web1.impulsecorp.com.34824 >
host2.bikeforums.net.http: . ack 2561801265 win 5840 13:14:45.445781 IP
web1.impulsecorp.com.34824 > host2.bikeforums.net.http: P 0:5(5) ack 1 win
5840 13:14:46.323924 IP web1.impulsecorp.com.34824 >
host2.bikeforums.net.http: P 5:10(5) ack 1 win 5840 13:14:47.402252 IP
web1.impulsecorp.com.34824 > host2.bikeforums.net.http: P 10:13(3) ack 1
win 5840 13:14:47.445109 IP web1.impulsecorp.com.34824 >
host2.bikeforums.net.http: . ack 361 win 6432 13:14:47.445200 IP
web1.impulsecorp.com.34824 > host2.bikeforums.net.http: F 13:13(0) ack 362
win 6432 13:14:50.464619 IP web1.impulsecorp.com.30659 >
host2.bikeforums.net.4474: S 1509142520:1509142520(0) win 5840 <mss
1460>
----
Same results from 87.117.199.30
root@host2 [~]# tcpdump src 87.117.199.30 tcpdump: verbose output suppressed,
use -v or -vv for full protocol decode listening on eth0, link-type EN10MB
(Ethernet), capture size 96 bytes 13:12:18.855810 IP server.hostgeekz.com >
host2.bikeforums.net: icmp 64: echo request seq 0 13:12:19.857654 IP
server.hostgeekz.com > host2.bikeforums.net: icmp 64: echo request seq 1
13:12:20.859378 IP server.hostgeekz.com > host2.bikeforums.net: icmp 64:
echo request seq 2
3 packets captured
3 packets received by filter
0 packets dropped by kernel