Forum speed issues

[metalphreak]

From a UK based server
                                                                         Packets               Pings
 Host                                                                   Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. ##################                                 0.0%    42    4.0   1.6   0.6   9.9   2.0
 2. 87.117.211.198                                                       0.0%    42    0.9   1.1   0.7  11.9   1.7
 3. 365.net1.north.dc5.as20860.net                                       0.0%    42    0.8   0.7   0.5   1.1   0.2
 4. 593.core1.thn.as20860.net                                            0.0%    42    1.4   6.7   1.3 212.2  32.5
 5. 202.core1.hex.as20860.net                                            0.0%    42    1.6   2.1   1.4  16.7   2.3
 6. bbr02.lon01.networklayer.com                                         0.0%    42    1.6   5.0   1.6  39.8   8.1
 7. ae1.bbr02.tl01.nyc01.networklayer.com                                0.0%    41   69.4  70.9  69.0  95.9   5.3
 8. ae1.bbr01.eq01.chi01.networklayer.com                                4.9%    41  118.3  95.0  90.9 118.3   7.5
 9. ae20.bbr01.eq01.dal03.networklayer.com                               0.0%    41  108.2 108.6 108.1 115.1   1.3
10. ae0.bbr01.sr02.hou02.networklayer.com                                0.0%    41  112.7 113.1 112.5 118.9   1.3
11. ae5.dar01.sr02.hou02.networklayer.com                                0.0%    41  114.0 115.5 113.6 135.3   4.7
12. po1.fcr01.sr02.hou02.networklayer.com                                0.0%    41  114.4 119.2 113.9 156.2  11.4
13. 184.173.12.165-static.reverse.softlayer.com                          0.0%    41  113.0 113.3 112.8 115.9   0.7

From a Western Australian Server


                                                                          Packets               Pings
 Host                                                                   Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. ###############                                            0.0%    20    0.9   0.6   0.2   1.1   0.3
 2. 218.100.54.109                                                       0.0%    20    2.2   2.0   1.5   4.0   0.5
 3. ge-0-0-501.bdr01.per01.wa.VOCUS.net.au                               0.0%    20    1.8   6.1   1.6  87.7  19.2
 4. ten-0-3-0-400.bdr02.per02.wa.VOCUS.net.au                            0.0%    20  206.9 207.3 206.1 219.2   2.8
 5. ge-0-1-6.cor02.syd03.nsw.VOCUS.net.au                                0.0%    20   50.7  51.3  50.6  56.8   1.3
 6. pos-1-2-2.bdr02.sjc01.ca.VOCUS.net.au                                0.0%    20  207.0 206.3 205.7 207.0   0.4
 7. te2-6.bbr01.cs01.lax01.networklayer.com.any2ix.coresite.com          5.0%    20  213.8 214.1 213.6 215.0   0.4
 8. ae19.bbr01.eq01.dal03.networklayer.com                               0.0%    20  242.3 242.9 241.6 257.8   3.6
 9. ae0.bbr01.sr02.hou02.networklayer.com                                0.0%    20  249.2 249.8 249.0 252.9   0.8
10. ae5.dar02.sr02.hou02.networklayer.com                                0.0%    19  257.5 263.8 246.5 296.3  16.5
11. po2.fcr01.sr02.hou02.networklayer.com                                0.0%    19  249.6 254.1 249.4 305.5  13.3
12. 184.173.12.165-static.reverse.softlayer.com                          0.0%    19  247.3 251.6 246.8 294.0  11.5

Clearly an issue with softlayer's network here.

You should reply back to hostgator support with these as examples, to show that it's a widespread issue (and not limited to just you on Telstra).

I assume your wordpress site is on the same server. Your browser is probably caching bits and pieces when it can't load them properly (many browsers actually have multiple threads requesting page elements simultaneously, some but not all of these may be failing)

[caroper]

I am with Afrihost Sean so Internet Solutions -> Seacom.
When the problem started I assumed it was another of the many Seacom outages so was pleased to see I was not the only one with problems.

[SeanB]

SNAP.............If I try Hellkom I can go and get a cuppa with many sites, as well as many that do not load at all.

[Neilm]

Currently I am having no problems viewing or posting. Yesterday (13th), I had a lot of problems at about 21:00. I checked it wasn't my connection by Skypeing my brother who lives the other side of London and he reported it was slow as well.

Neil

[alm]

7. ae1.bbr02.tl01.nyc01.networklayer.com                                0.0%    41   69.4  70.9  69.0  95.9   5.3
 8. ae1.bbr01.eq01.chi01.networklayer.com                                4.9%    41  118.3  95.0  90.9 118.3   7.5
 9. ae20.bbr01.eq01.dal03.networklayer.com                               0.0%    41  108.2 108.6 108.1 115.1   1.3

 6. pos-1-2-2.bdr02.sjc01.ca.VOCUS.net.au                                0.0%    20  207.0 206.3 205.7 207.0   0.4
 7. te2-6.bbr01.cs01.lax01.networklayer.com.any2ix.coresite.com          5.0%    20  213.8 214.1 213.6 215.0   0.4
 8. ae19.bbr01.eq01.dal03.networklayer.com                               0.0%    20  242.3 242.9 241.6 257.8   3.6

Clearly an issue with softlayer's network here.

Nah, the hops before and after it are fine. Just a busy router assigning a low priority to ICMP traffic destined to this router, as is common on core routers (who cares about core router ICMP traffic?).

[amspire]

The forum speed is returning to normal for me. I still think that downstream caches got junk in them after the problems of a day ago.  This caused the requests that did get back to   the forum to confuse the forum software totally, particularly with "reply" type pages.

As the junk in the caches is clearing, everything starts to work again. No real evidence, but that is my guess.

Whatever that plugin did that caused this problem, it was pretty bad. If it was my site, I would even change the admin forum and WordPress passwords in case the plugin included some malicious software.

Richard.

[EEVblog]

It does seem better this morning, I haven't had a missed request yet.
It would be interesting to re-enable that wordpress plugin (it's not an unpopular one) and see what happens.

Dave.

[amspire]

It does seem better this morning, I haven't had a missed request yet.
It would be interesting to re-enable that wordpress plugin (it's not an unpopular one) and see what happens.

Dave.

The fact it messed up the Simple Machine's forum which I gather is a totally separate program makes me wonder if part of the problem is that this Wordpress plugin was redirecting requests to a third party site. I think that you do a redirect to get from Wordpress to the SMF, and I think the Youtube comment Wordpress plugin was somehow interfering with this redirect. Somehow the connection was eventually made, but perhaps via another 3rd party address. The problem part of the code was possibly ending up in downstream caches, and not immediately timing out.

Otherwise, I am not sure how a Wordpress plugin affects a Simple Machine forum.

Edit: Today, if I go to www.eevblog.com/forum in Chrome, I end up with this in the address bar:

https://www.eevblog.com/forum/

Yesterday when the forum was really bad, and the pages were stalling, I got this in the address bar instead:

https://www.eevblog.com/forum/index.php?PHPSESSID=a864ac13390b3ada2a7ecb531b3394be;wwwRedirect

There is a PHP session ID attack that allows a hacker to gain access to a site:

http://www.acunetix.com/vulnerabilities/PHPSESSID-session-fixatio.htm

Richard.

[EEVblog]

Edit: Today, if I go to www.eevblog.com/forum in Chrome, I end up with this in the address bar:

https://www.eevblog.com/forum/

Yesterday when the forum was really bad, and the pages were stalling, I got this in the address bar instead:

https://www.eevblog.com/forum/index.php?PHPSESSID=a864ac13390b3ada2a7ecb531b3394be;wwwRedirect

There is a PHP session ID attack that allows a hacker to gain access to a site:

http://www.acunetix.com/vulnerabilities/PHPSESSID-session-fixatio.htm

Hmm, interesting, I need to check this out.
The plugin is this one:
http://wordpress.org/extend/plugins/genki-youtube-comments/

Dave.

[HackedFridgeMagnet]

The Session attack theory doesn't explain my failed direct http request to
https://www.eevblog.com/forum/Themes/default/css/index.css I also tried one of the javascript pages and failed.

trace route seemed ok from memory.

I was thinking at the time Network, Webserver low resources, or DDOS.

I'm glad it's better today.

[EEVblog]

I was thinking at the time Network, Webserver low resources, or DDOS.

It's not my dedicated server, it's running well under capacity, and no spike in traffic at all.
I don't share this machine with anyone, it's all mine.

Dave.

[HackedFridgeMagnet]

it's running well under capacity

Just checking,
I guess you would have checked the resources yesterday, when the problem was there.
available memory, cpu utilisation, hard disk swaps.
Maybe that plugin couldv'e sucked up resources for whatever reason.

[vk6hdx]

Seems fine for me today Dave.  Everything seems to be loading rather quickly.

[Psi]

Yeah, i've not had any issues for all of today.

[EEVblog]

Seems fine for me today Dave.  Everything seems to be loading rather quickly.

Yep, me too.
Problem fixed I guess.

Dave.

[Joshua]

About an hour ago, I also received the url that ampsire did (the php attack thing). Just now I received  https://www.eevblog.com/forum/index.php?wwwRedirect


I've never seen the wwwRedirect at the end before.


Joshua