Intermittent service

[beowuuf]

Hey all!

Gambit informed me that his webspace was coming under DDOS attack, so if you get intermittent service, that will be why.


Things seem to be ok for the moment... *fingers crossed*

[Seriously Unserious]

DOS attacks are probably one of the nastiest and easiest attacks anyone can do. I hope these attacks end soon, Gambit definitely does not deserve any of them. the Ping tool is one of the ways such an attack can be done, so if they're still going on, try setting your site up to ignore ping requests and see if that makes a difference.

[Lord_BoNes]

What scale is this DOS attack (how much is it lagging the server)? Is it frequent bursts of lag? Or is it consistent lag?

Isn't there a way to block all activity from a certain IP address (even though it still has to filter the packets, which takes time... but less than returning the ping)?

I personally wouldn't be against the idea of blocking ALL traffic from the culprit (which would mean that if they're a member, then they'd lose the ability to view the forums... diddums, that's what ya get for attacking it in the first place ).

[beowuuf]

It wasn't this site, it was all of Gambit's space. And I haven't actually seen any outage since Gambit warned me about it. So that's good.

[Lord_BoNes]

Good to hear that the forums are out of the woods... but, it's a shame that Gambit's space was under attack.

[Gambit37]

It wasn't just my space, it was the host's shared server on which my stuff is stored. They minimised the damage pretty quick by blocking the source of the attack, whatever it was.

[Seriously Unserious]

Isn't there a way to block all activity from a certain IP address (even though it still has to filter the packets, which takes time... but less than returning the ping)?

There is, but that will only work if the culprit isn't using IP spoofing or routing the attack though slave computers first, in this case you either won't be able to get a consistent IP address to block or the attacker will just change it and resume the attacks. In that case a more sophisticated approach would be needed.

Attacks like this are a pain in the ass and that's for sure, hope you get this sorted out and don't get any further attacks to your site(s).

[Lord_BoNes]

DoS attacks are probably the most common form of attack. And, yeah, I've seen that they can become quite a pain-in-the-ass to stop... especially if the attacker has many computers at their disposal (the attacks coming from several different locations... much harder to stop).

[Seriously Unserious]

and anyone who learns a bit about how the TCP/IP protocols work should be able to find a way to "spoof" their IP address so it appears to be something different but looks valid to the receiving computer. Combine this with a script written for the attacker's OS of choice and you have a recipe for disaster for some unfortunate victim. Unfortunately there are sicko's out there that seem to think this sort of behavior is justifiable and/or funny and will either launch a targeted attack on someone, or even just attack someone at random, depending on whether it's some misguided attempt to express a grievance or just some jerk "having fun" at someone's expense.

In Gambit's case, I'd say it was probably the latter, a completely random attack for no particular reason -- at least none any sane person would understand...

[Gambit37]

FYI: There's intermittent problems with my hosting provider today, so the forums may be offline temporarily throughout the day.

[terkio]

Indeed, I noticed an outage about an hour ago.

[Gambit37]

For the record, I deleted the last few posts here as they were not about the subject of this thread.
Please remember to stay on topic, particularly in informational threads by admins regarding the forums.
Thank you.