Home page logo

nanog logo nanog mailing list archives

Slow and Fast IP addresses on http ?
From: <drueegg () emea att com>
Date: Mon, 16 Jun 2003 22:53:15 +0200

Did anybody ever hear about IP-addresses which get a slow treatment from
some http servers ?

We have a 195.212.127/24 out of a /16 PA range which is behaving very odd
with multiple WEB servers but works fine with most others.

When we configure an IP out of 195.212.127/24 on an direct Internet
connected workstation, it takes about 1-2 minutes to start loading pages
from some WEB servers, but it is fast for all other pages. When we then
configure any other address out of this /24 onto the same client, everything
works fine.

We checked the WEB servers in question and they use various operating
systems and Server software, so it does not seem to be a bug on the server
A bug on the client side can be excluded as well because we tried various
clients and it always works fine when an address outside the 195.212.127/24
is used.
Routing also can't be the problem because after the "long" break traffic
flows smooth.

195.212.127/24 has for ex. problems with web-sites:

No problems with web-sites:
http://www.yahoo.com and

No problems to all of the above pages when using any other client IP address
but the same Client Workstation and connectivity.

Sniffering on the client side shows, that the session establish goes
1. Client->Server HTTP: GET / HTTP/1.1$
2. Server->Client TCP: TCP: src = 80, dst = 1944, ack = 0X3A577E76 ACK
3. Client->Server HTTP: HTTP/1.1 200 OK  (http data is received now)

Using a client address outside the range in question or going to a "good"
HTTP-Server, goes through above three steps within some milliseconds.
Using an address out of 195.212.127/24 and going to a "bad" HTTP-Server,
works fine but then stucks for .5 to 2mins before going to above Step 3 and
then all traffic flows smooth.

To me it seems like the Servers are doing some intensive investigations on
this IP addresses before getting the OK to process them. I have never heard
of such a service. DNS/and reverse DNS can be ruled out as well as other,
working addresses, are configured the same.

Does anybody have any idea what the problem could be ?


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]