Finally solved my Wii-U eShop error issue!

We've been trying to purchase the Pikmin 3 DLC for the last week or so. Everytime we get through about half way through the eShop purchase, the eShop app gets an error code (useless!) and exits.  Sometimes we get further than other times, and once it fails, it seems to fail faster.

Using the Nintendo Wii-U eShop seems to be a common problem found on the Nintendo forums. Originally it was an issue with the Wifi reception. But there still seems to be a few cases here and there, and we use a wired connection. I was stumped. It didn't seem to matter what time of day either.

So today I was looking at my firewall logs and noticed:
[4582372.494624] iptables drop ratelimit: 
IN=eth0 OUT= MAC=... SRC=23.7.194.90 DST=... LEN=93 TOS=0x00 PREC=0x20 
TTL=59 ID=27348 DF PROTO=TCP SPT=443 DPT=4040 WINDOW=18666 RES=0x00 ACK PSH URGP=0
A lot of those.  That's weird.  That IP is an akamai address.  And I seem to get a lot from them from akamai's port 443 to a random port on my system.

Akamai says: http://www.akamai.com/html/support/faq.html
Our firewall has detected that Akamai-controlled IP addresses are attempting to access our IP address via a number of different ports. This seems to be an attack. What is going on? 

The messages you see indicate that users behind your firewall are running the Akamai NetSession Interface. The Akamai NetSession Interface is a download manager client that is used on behalf of an Akamai customer to download software or other digital content. The Akamai NetSession Interface uses both TCP and UDP based protocols to download content and facilitate connectivity through network devices such as proxies, firewalls & NAT (network address translation) devices.
Huh! I wonder if Nintendo is using a similar download manager protocol in the eShop for the interface.  Or maybe I have downloads downloading in the background that is triggering a firewall rule.

Now about that rule -- the rule I have is that if you send me enough packets that I decide to drop, I blacklist the IP:
-A INPUT_FORWARD_FW -i eth0 -j DROP -m recent --set --name badguys     
 Combined with the following to just drop all of their packets:
-A INPUT_FORWARD_FW -i eth0 -m recent --rttl --name badguys --update --seconds 60 -j DROP       
Once I removed the first rule, I was immediately able to complete an eShop transaction.

So I wonder how many people out there who are having trouble with the eShop are having trouble from smart firewall routers (mine is Linux) that blacklist IP addresses if they try to contact blocked ports too often.

...And tomorrow we shall try out the new Pikmin levels!  :)

Comments

Post a Comment

Popular posts from this blog

Repairing a Moenstone Composite Granite Sink

A few years ago we remodeled our kitchen and went with an undermount Moenstone sink. This Thanksgiving I noticed a hairline crack in the bottom. We called Moen and they were willing to give us money or a new sink as part of the warranty (which is great!), but the sink is undermounted. We'd probably need to remove the entire countertop to put a new one in, and Moen no longer makes them. Our choices were either to repair it, install a drop in sink, or maybe find another undermount sink with a similar profile. A new undermount probaby requires taking off the countertop and recutting.  A drop-in requires recutting the counter.  Ugh! So... I researched how to repair composite granite sinks.  I didn't find a whole lot of information. Some people suggested epoxy. We are one day (2015-12-19)  into our repair, still waiting for the glue to set, but I wanted to document my process. The foundation for our repair is a Simpson Strong-Tie product I found for repairing c...
Read more

When to ask for help when stuck on a technical problem

I thought this blog post by  +Matthew Ringel was a concise and useful summary of how (and when) to ask for help when stuck on a technical problem: https://blogs.akamai.com/2013/10/you-must-try-and-then-you-must-ask.html I often find coworkers skipping step #1: working at the problem a little longer and documenting/recording/reviewing what you've already tried. When I do step #1 I often solve the problem myself.  I might be in the middle of an email explaining what the problem is.  I owe it to them to explain what I've tried, what results I got, etc.  Most of the time the solution then presents itself!  I then just delete the email draft and keep plugging away. But then sometimes I wait too long for step #3 - going and asking for help. And then sometimes, I just need a rubber duck: http://www.rubberduckdebugging.com/
Read more

Western Digital Green Drives and Linux - They're dying!

The last time I swapped the drives out in my home built NAS, I bought Western Digital Green drives.  They sounded great!  Low power, low heat, low noise... Unfortunately, they appear to not have been built for this particular application.  They auto park and the timer is set too low for Linux filesystems.  (I believe the default may be 8 seconds! http://techreport.com/forums/viewtopic.php?f=5&t=78891) My drives began to give me trouble (thankfully) even before the warranty ran out.  I found the load cycle count on my drive to be extremely high - 10's or 100's of thousands.  This is way beyond the expected count. Here's how to query for it: # smartctl -A /dev/sdX | grep ^193 193 Load_Cycle_Count        0x0032   200   200   000    Old_age   Always       -       XXXXXXX Luckily there is a solution -...
Read more