Re: [gentoo-user] Bizarre SSH connection reset

[fire-eyes <sgtphou@fire-eyes.org>]

> Hmm, I don't know  . . . The particular address I was trying to connect was 
> definitely blocked.  Other than not beeing able to connect with a browser, 
> nc, httping and tcptraceroute confirmed it).  Could it be an area/account 
> specific block perhaps?  When I questioned the owner he said that this was 
> common practice and that his ISP does not allow webservers to run.

Get me a full packet capture of the entire ssh session, and I'll have a 
look at it.

Install tcpdump if you don't have it: emerge tcpdump

If you already have it or it's now installed, as root, just before you 
start the session:

tcpdump -i dev -s 0 host IP and port PORT -w ssh-session-1.pcap

where host is the IP you are connecting to, PORT is the port you're 
connecting to, and dev is the network interface it's going through (such 
as eth0).

Log in, do your thing, and after the ssh session craps, ctl-c the 
tcpdump. Send the file directly to me, sgtphou@fire-eyes.org. The 
information I'll be able to see is the client and server IP, port, ssh 
client version, and user name, fyi.

I'll reply directly to you and if you agree, we'll post the findings to 
the list.
-- 
gentoo-user@lists.gentoo.org mailing list