Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

JUST.HOSTING HOT Summer Sale ★ UP TO 50% OFF VPS + 35% RECURRING ★ 30 SELECTED LOCATIONS

2»

Comments

  • zGatozGato Member
    edited August 17

    @forest said:

    @zGato said:

    @forest said:

    @zGato said: At least this is a more decent suspension reason, although still being false positives. I wouldn't really want to block outgoing to port 22. What about weighting a flag before suspension with other DBs (e.g. AbuseIPDB, even if I completely dislike it) ?

    As far as I know, Globalping never connects to port 22. It can only do traceroute/mtr, connect to HTTP(S), do DNS lookups, and ICMP echo request. I don't know about the RIPE Atlas probe, but you can probably safely block port 22. It's very possible that you'll keep getting false positives, though.

    You can with Globalping:

    You can't do it directly with RIPE Atlas, but you can do a TCP traceroute to port 22.

    Oh, that's interesting. I assume if you block 22, the system will just mark your probe as unable to connect to 22. If not, then that would be a serious limitation.

    With Globalping at least it will just timeout:

    (Onidel blocks outgoing 22 by default)

    I don't think there are many ways for Globalping to know if the port is blocked internally by the VM or by some country firewall, which defeats one of the main purposes of a probe network :(

    That's why I'd rather cancel all my servers with justhost before dropping port 22 or stopping my probes.

    Thanked by 2Obelous oloke
  • forestforest Member

    @zGato said: I don't think there are many ways for Globalping to know if the port is blocked internally by the VM or by some country firewall, which defeats one of the main purposes of a probe network :(

    @jimaek Are there any tests Globalping does to determine if a probe should be considered eligible for use to connect to a specific port? Could you perhaps add a feature that would allow probes to send back a list of ports it can or cannot connect to, similarly to the way a Tor exit policy works?

  • zGatozGato Member
    edited August 17

    Oh nevermind, they use AbuseIPDB right now, auto suspend for any bogus report, very cool!

    what a shitshow 😂

    Thanked by 2tentor Nekopara
  • forestforest Member

    @zGato said: Oh nevermind, they use AbuseIPDB right now, auto suspend for any bogus report, very cool!

    That's bad. There are some services that incorrectly auto-flag Tor middle relays, e.g. xmission.

    Thanked by 1zGato
  • zGatozGato Member

    @forest said:

    @zGato said: Oh nevermind, they use AbuseIPDB right now, auto suspend for any bogus report, very cool!

    That's bad. There are some services that incorrectly auto-flag Tor middle relays, e.g. xmission.

    That account should be banned from AbuseIPDB, gotta say.

    Thanked by 1forest
  • forestforest Member
    edited August 17

    @zGato said: That account should be banned from AbuseIPDB, gotta say.

    I'm actually in correspondence with their support. They said a few weeks ago (after a short back-and-forth where they kept assuring me that they do not own the abuseipdb.com domain before realizing what I was talking about and confirming that they owned the xmission account there) that they would escalate the matter to see what could be done. I just sent a follow-up now requesting an update.

    At the very least, I hope for them to whitelist relays' address:ORPort tuple and not report them. I have some hope because they are a very pro-privacy ISP in Utah, and they aren't so massive that support is /dev/null.

    Thanked by 1zGato
  • Belgrade Location?

  • jimaekjimaek Veteran

    @forest said:

    @zGato said: I don't think there are many ways for Globalping to know if the port is blocked internally by the VM or by some country firewall, which defeats one of the main purposes of a probe network :(

    @jimaek Are there any tests Globalping does to determine if a probe should be considered eligible for use to connect to a specific port? Could you perhaps add a feature that would allow probes to send back a list of ports it can or cannot connect to, similarly to the way a Tor exit policy works?

    We have no special logic related to ports. We pass the port directly to the utility to run the test and return the results as is.

  • forestforest Member

    @jimaek said:

    @forest said:

    @zGato said: I don't think there are many ways for Globalping to know if the port is blocked internally by the VM or by some country firewall, which defeats one of the main purposes of a probe network :(

    @jimaek Are there any tests Globalping does to determine if a probe should be considered eligible for use to connect to a specific port? Could you perhaps add a feature that would allow probes to send back a list of ports it can or cannot connect to, similarly to the way a Tor exit policy works?

    We have no special logic related to ports. We pass the port directly to the utility to run the test and return the results as is.

    So if a probe has to disable, say, port 22, that's bad for the network due to the skewed results?

  • jimaekjimaek Veteran

    Technically yes but I don't like the alternative of port scanning. Our quality control focuses more on packet loss rather than port availability

  • forestforest Member
    edited August 18

    @jimaek said: Technically yes but I don't like the alternative of port scanning.

    Not scanning, but allowing probes to voluntarily provide a whitelist or blacklist of their abilities via the API. So for example, zGato's probes could return that they don't support TCP/22, and then any requests to connect to TCP/22 simply wouldn't be routed to any of his probes.

    It might even be feasible client-side by having the probe return a refusal over the API rather than return false results (like a connection timeout). Essentially telling the API "I'm alive and I received the request, but I can't satisfy it".

    Thanked by 1Obelous
  • jimaekjimaek Veteran

    I understand, yes that sounds doable, I'll add it to the backlog

    Thanked by 1forest
  • forestforest Member
    edited August 19

    @antonpa I'm receiving more false abuse complaints. This time three duplicates for a single incorrect AbuseIPDB entry (somehow your system is triple-reporting the same report). Looking at it again, it's another false positive to port 9001 (Tor).

    Please be aware that anyone can create an AbuseIPDB entry. It is not authoritative.

Sign In or Register to comment.