Harvard-Smithsonian Center for Astrophysics Computation Facility Network Support Services

Why was my connection to CfA rejected?

A. A common cause for rejected connections is that CF-managed machines reject connections from machines which are not properly registered with a nameserver. Both the name-to-number and number-to-name lookups must work (consistently), and it is not uncommon for ISP's to get this wrong. It may even be right for some dial-ins from an ISP and wrong for others from the same ISP. Unix machines may also need to have the correct hostname configured, but for PC's, the locally assigned name doesn't seem to matter.

Q. How can I tell if my IP address is properly registered?

A. You can find out what IP address your ISP has given you with the commands

• winipcfg (Win/9x/ME)
• ipconfig /all (Win/NT/2000/XP in a command window)

• checkip.dyndns.org
• www.findmyip.com
• www.ipchicken.com
• whatsmyip.smokingmedia.com
• www.whatismyip.com
• www.whatsmyip.org With a dial-in account, you'll get a different address with each dial-in. Cable and DSL connections may or may not use static IP addresses. Once you know your IP address, you can use the nslookup command to get the corresponding name (if the nameserver registration is ok). Unfortunately, Win/9x doesn't provide the nslookup command, but you can try the lookup at one of these websites:
  • www.infobear.com
  • www.kloth.net
  • namespace.pgmedia.net
  The number-to-name and name-to-number lookups must both work (and be consistent).

  Q. I'm still not sure what's wrong, do you log the reasons for rejected connections?

  A. Yes, rejected connections are logged. If you tell cfunixhelp

  • the name of machine you were attempting to connect to
  • the time of the attempt
  • your IP address if you know it
  someone will check the logs.

  Q. My IP address seems to be properly registered. Is there any other reason why I might be disconnected?

  A. Other possibilities

  • Some addresses may be blocked because they have been sources of cracking attempts. Please email cfunixhelp@cfa with your IP address and hostname for more information.
  • A nameserver may be temporarily down
  • An ISP should have two authoritative nameservers. We've seen a case where one authoritative nameserver responded to the reverse lookup but the other did not, so whether or not you could connect to CfA depended on which nameserver got asked.

  Q. I'm visiting another institution, at a meeting, etc., and they have given me an Internet connection that isn't registered with a nameserver. Can you do anything for me?

  A. We can make temporary exceptions. Please tell us the IP address or IP address range and the date range needed.

  Q. Does this also apply to email?

  A. It may limit your ability to read mail.

  • If your IP address isn't properly registered, you will not be able to make a POP3 connection to read email.
  • Connections from the outside world sending mail to CfA are accepted unless the name and IP address are inconsistent in nameserver lookups. This is rare; the usual problem is nothing found at all.
  • Connections from the outside world attempting to use the CfA SMTP server to send mail to addresses outside of CfA are rejected. This is standard practice these days. Sites that do not do this are quickly found by spammers and used for sending junk email. Your ISP should provide an SMTP server for you to use for sending mail.

  Q. Why do you care about my nameserver registration?

  A. It's a security concern. Not every connection from the outside world is a friendly connection. Attacks are less likely to come from registered nodes because the registration information helps us trace back to the source.

  Q. Is there any way I can work around the nameserver requirement?

  A. Yes. Install and use VPN software.

  For errors or questions about this page, contact netadmin@cfa.