Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm experiencing a really weird issue on my Ubuntu 10.04 web server where something appears to be intercepting my network requests. Most importantly it's preventing me from performing local connections, and so my HTTP server can't connect to its database.

All local connections hang and eventually timeout.

$ curl -v localhost
* About to connect() to localhost port 80 (#0)
*   Trying 127.0.0.1...

This is true for whatever port I use, and also happens to other clients like wget, regardless of whether there is something being served on that port.

Remote requests work as expected if the requested server exists. If the URL I provide doesn't point to anything, then it resolves to the IP 208.87.35.103, which I don't know anything about. That address returns a 404 with an empty body.

So at this point I'm thinking that there's something intercepting all of my requests and trying to determine if the resource exists before returning the response. This might explain why the local connections are hanging, because the interceptor is constantly intercepting its own requests. I have no idea why it would be redirecting to another server first, and this is the part that really confused me.

This started happening after the server was rebooted for maintenance. I ran some apt updates before this, and I can't remember if I restarted the server afterwards, so this could be the cause. I don't know why a standard apt update would affect this sort of thing, though. Unfortunately I don't know enough about the DNS/IP process for the server to understand if this is just something like a misconfiguration.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

My first thought is that there is a firewall blocking things. Check 'iptables -L' or 'ufw status' (both will probably require sudo).

But a quick google for the ip address you mentioned indicates that the IP address you mentioned may be "bad", and you should probably start looking for rootkits or other infections.

share|improve this answer
    
Thanks. The redirect had me worried, although standard rootkit checks didn't turn anything up. I think I'll try and get the server reverted to a backup, just to be sure. –  zmthy May 25 '13 at 18:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.