MacOS – What steps can troubleshoot OS X when some sites do not resolve on Snow Leopard

internetmacosNetworksnow leopard

I cannot access www.lubuntu.net from my Macbook Pro running OS X 10.6.8. I have an idea as to what the problem is (see my opinion), but I did all the usual things anyway (see basic troubleshooting), just to check.

Basic Troubleshooting

I can access almost any other site from my macbook (for example this one). I can access lubuntu.net from my other laptop which is on the same wifi, meaning it's not a network, ISP, or router issue. Also the site is up, and this issue is persistent for several days.

I can successfully ping the site. The site resolves to an IP (thus not a DNS issue). The problem occurs using three different browsers – Chrome, Firefox, Safari. I never use Safari, so it's not an extension issue, either. I cannot access the site even if I paste its IP into the address bar.

My IP is likely not banned, since (1) there is no reason to ban me and (2) my other laptop is able to access the site over the same network, going through the same router.

Rebooting does not solve the issue.

My Opinion

I installed (and quickly uninstalled) a program called PeerGuardian, which blocks "suspicious" IPs. It is mainly used for blocking unwanted peers when downloading torrents. I think that it messed with one of the config files to block the Lubuntu site.

Which files should I check? I've taken a look at /etc/hosts, and that looks fine. Also /etc/resolv.conf looks normal. No idea where to go from here.

EDIT: Here are the contents of system.log for my most recent attempt:

Oct 18 21:44:11 albatross com.avast.proxy[50]: Error reading receive buffer: read(): Connection reset by peer

Oct 18 21:45:20 albatross com.avast.proxy[50]: Defective HTTP request!

Oct 18 21:45:20 albatross com.avast.proxy[50]: Unexpected AV CHECKURL response code (501)!

Oct 18 21:46:24 albatross [0x0-0x165165].com.avast.AAFM[2093]: 18 Oct 21:46:24 ntpdate[2133]: no servers can be used, exiting

Oct 18 21:46:27 albatross avast![2093]: event_master_disconnected

Oct 18 21:46:38 albatross com.apple.launchd.peruser.501[322] (com.avast.helper): Throttling respawn: Will start in 5 seconds

Oct 18 21:46:45 albatross com.avast.proxy[50]: Error reading receive buffer: read(): Connection reset by peer

Do you think this is a problem caused by Avast? But I installed avast after the problem started, because I thought it might be a virus, so that doesn't make much sense…

EDIT 2: added contents of /etc/hosts below

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.

127.0.0.1   localhost
255.255.255.255 broadcasthost ::1             localhost
 fe80::1%lo0    localhost

Best Answer

In agreement with the original poster, in this answer I put together the comments above that describe the troubleshooting steps that helped solve the issue.

  1. Realize that PeerGuardian uses a KEXT.

    As strangelydim commented, PeerGuardian (an open source privacy oriented firewall software) uses a kernel extension (KEXT). The KEXT is used to block connections to "dangerous" servers specified in so-called blocklists.

  2. Find out whether the KEXT was the culprit.

    The original poster booted his Mac into Safe Mode by pressing Shift during startup (http://support.apple.com/kb/HT1533).

    Safe Mode does a lot of things (http://support.apple.com/kb/HT1564), among them it loads only required kernel extensions, so PeerGuardian's KEXT wouldn't be loaded.

    The original poster could successfully connect to www.lubuntu.net, so the KEXT was the offender.

  3. Disable the KEXT.

    The first try was to move the KEXT from /Library/Application Support/PeerGuardian to /tmp and reboot. That didn't help. The original poster then deleted the KEXT. I also asked him to check in System Preferences>Users & Groups>Login Items whether PeerGuardian was listed and remove it.

    After a reboot he could sucessfully connect to www.lubuntu.net.

So the bottom line is that, unfortunately, some programs cannot be uninstalled by simply dragging them to the Trash.