408 Request Timeout - Intermittant problems with regular websites

I run a number of websites hosted on a 3rd party server. I am getting intermittent access problems with these websites, whereby I will not be able to access the website or email for 5 mins or so then it will suddenly become available again.

Here's what I know so far:

• It appears only to affect 5 websites hosted by a particular company. When one goes, it seems the others go at the same time.
• However, there are two other websites hosted by the same company that DO work ok when I can't access the other 5.
• All of the websites are hosted on different physical servers, except two of them which are on the same server (although under different IP addresses). Just to confuse things one is one of the 2 'working' websites, and the other is one of the 5 'non-working' websites.
• When these websites go 'offline' to me I can still access the internet, and when I try a bunch of random websites they all seem to work as well. So it's not my internet cutting out - It just seems to be a problem with these 5 websites.
• The hosting company says that at the times I have reported the problem: The servers are not under any particular load; no-one else is reporting problems with their websites; other people are accessing my websites;
• They have also provided some error logs which show my browser accessing the website at the time of the problems, with some successful responses but also some errors (408 request timeout); They report that they have searched the log and the 408 request timeout errors only occur for my IP address. Given that other people are accessing the site while I am getting timed-out, this seems to be the biggest clue.
• During the outages on 1 particular website (I have decided to focus on one for simplicities sake), while I was unable to access the website or email, I was able to both PING and TRACERT the server by name successfully - so there was successful DNS resolution and successful communication between my client and the server. Just not necessarily successful HTTP communication.

So basically, as far as I can tell, the error is between my PC and these 5 websites at a particular host; but while the problem is happening I can see other websites at the same host, and one on the same server;

Can anyone suggest what might be the issue here? Or what my next troubleshooting steps may be?

Warning: Possible red herring alert - This may be related or could be a completely different issue... but: I am having problems receiving emails for one of these sites from one particular sender. I appear to be getting emails ok from everyone else (that I know of, no-one else has notified me of any problems but if I'm not receiving emails from them then how would they...) but from this one particular company only some of the emails are getting through. The others bounce with this error:

(from bounce message)
#< #4.0.0 X-Spam-&-Virus-Firewall; conversation with mail.[mydomain].co.uk[95.154.xxx.xxx] timed out while sending MAIL FROM> #SMTP#

(corresponding error from receiving server log)
SMTP connection from mail3.[senderdomain].com [195.224.xxx.xxx] lost while reading message data (header)

So, communication lost mid comms? Sounds very similar... but could be unrelated.



Ps. This is on a Win 7 64bit PC, website issues experience with IE and Chrome (browsing) and Mailwasher (email)

Does this issue happen when you request access to a particular page or area of the site? Are you able to retrieve the index page of the site(s) after they have appeared to go offline? I have a feeling this is a potential issue at the application layer with HTTP and could be a tricky thing to diagnose. Do you have any logs that you are able/willing to share that could shade some light on this bizarre issue?

I may need to ask for a packet capture of what occurs in order to get a better understanding from a per packet level of what is going on. Again some unwanted information may be given while you are capturing the packets during the supposedly offline website therefore the decision is up to you.

My apologies if you have already mentioned, what is the Operating System and Web server service that is running on the affected sites? And also the same for the sites that do not have the issue?

Many Thanks,
Josh :)

Wireshark is a free open source protocol analyser and will allow us to filter out the extraneous traffic. Unfortunately no packet capture will filter traffic at capturing but afterwards when reviewing traffic it can be filtered.

Wireshark · Go Deep.

If you can, run the capture when you receive the error so we can see the bad HTTP requests sent out and possibly investigate what traffic is being sent back to you from the server which could help with identifying the problem.

   Warning

This process will capture any traffic flowing between your machine and the server. Try and avoid entering any sensitive information while you have the capture running as it could be captured as well. It should be encrypted and unreadable however best practice is to avoid having it captured to begin with.

   Note

If you have other devices on the network then try to disconnect them from the network or not use it while the capture is running since some remnants of their communication could be captured.

To start the capture first open the application after installation. After this choose the interface that you wish to capture traffic on (This should be the interface you use to connect to the internet/web server). Then click on the start button.



After this it should begin to capture the traffic and you will see some action happening in the table. This is all the network traffic that is being sent to and from your machine and is being captured. During this try and replicate the error message you are getting so we can see the packets in more detail in the capture. After that is done simply press the stop button to stop the packet capture.



Now that the capture has been stopped you can now save the capture by clicking on File > Save As...



Give it a name and make sure you save it as a pcap file. It should be the default file type anyway.




Now that the capture has been saved please place it into a ZIP folder and then attach it to your next post and I will have a look and see if I can find anything in the packets that could indicate the potential problem

See this tutorial on how to attach files to your next post - Screenshots and Files - Upload and Post in Seven Forums

Hope This Helps,
Josh :)