TPU Connectivity Issue. 6/17/09

[erocker]

While I'm able to connect to http://forums.techpowerup.com just fine, I cannot access the front page, review section, downloads etc. Here is the traceroute:

TraceRoute to 74.86.91.2 [www.techpowerup.com]

Hop (ms) (ms) (ms) IP Address Host name
1 56 6 14 72.249.0.65 -
2 13 9 6 206.123.64.22 -
3 11 6 6 216.52.189.9 -
4 24 Timed out 11 216.52.189.18 softlayer-11.border4.ext1.dal.pnap.net
5 13 13 6 66.228.118.207 po2.dar02.dal01.dallas-datacenter.com
6 9 11 12 66.228.118.182 po2.fcr02.dal01.dallas-datacenter.com
7 9 11 7 74.86.91.2 -

[intel igent]

working fine for me :o have you recently updated/switched your browser or something? maybe a setting there :confused:

[erocker]

Naw, it was happening to me at work too. It started around 4:15pm CST.

[Arrakis+9]

me as well.. at work and here too

[sneekypeet]

same here, funny thing is, I can get here through email links, but if I use my Favorites link, it takes forever to load.

[intel igent]

i haven't had any issues at all with logging in throughout the day? maybe they are refreshing the site or something? :confused:

[sneekypeet]

most likely an issue with our local TPU server...Texas I think. My page isnt loading correctly yet either. Cold Storm in Florida was having the same issues as well.


It simply isnt on our end intel;) Maybe a storm hit Texas?!?!?!

[Mike0409]

I've been having issue's at work. From home I was fine tho.

[temp02]

I too have been having issues for the last few days accessing TPU (insanely big loading times and interrupted connections), here is a trace route:
tracert www.techpowerup.com

1 16 ms 15 ms 16 ms bl3-73-17.dsl.telepac.pt [213.13.73.17]
2 16 ms 16 ms 16 ms lis1-cr1-po0-5-4-0.cprm.net [195.8.0.93]
3 48 ms 48 ms 48 ms lon2-cr1-po10-0-0.cprm.net [195.8.0.94]
4 48 ms 49 ms 48 ms lon1-cr1-gi-3-0-0.cprm.net [195.8.0.217]
5 45 ms 44 ms 44 ms xe-7-2-0.edge3.London1.Level3.net [212.113.15.89]
6 49 ms 49 ms 48 ms ae-34-52.ebr2.London1.Level3.net [4.69.139.97]
7 113 ms 112 ms 113 ms ae-43-43.ebr1.NewYork1.Level3.net [4.69.137.74]
8 127 ms 125 ms 126 ms ae-81-81.csw3.NewYork1.Level3.net [4.69.134.74]
9 119 ms 124 ms 126 ms ae-84-84.ebr4.NewYork1.Level3.net [4.69.134.121]
10 156 ms 161 ms 162 ms ae-3.ebr2.Dallas1.Level3.net [4.69.137.121]
11 148 ms 158 ms 148 ms ae-72-72.csw2.Dallas1.Level3.net [4.69.136.142]
12 154 ms 153 ms 153 ms ae-2-79.edge3.Dallas1.Level3.net [4.68.19.72]
13 154 ms 154 ms 153 ms te2-1.cer01.dal01.dallas-datacenter.com [4.71.198.18]
14 154 ms 153 ms 154 ms po1.dar02.dal01.dallas-datacenter.com [66.228.118.203]
15 154 ms 154 ms 170 ms po2.fcr02.dal01.dallas-datacenter.com [66.228.118.182]
16 154 ms 155 ms 153 ms www1.techpowerup.com [74.86.91.2]

[newtekie1]

Same issue here, both at home and work.

If it helps, both connections are AT&T. I know our hosting company recently screwed something up that blocked their servers to all AT&T connections, but every other ISP was getting through.

[Assassin48]

same here
i couldn't connect to tpu on
pc, ps3 , or itouch

[EastCoasthandle]

You may need to add the forums to your favorites in order to get to this website for now IMO.

[CrackerJack]

same here! i'm come from my favorites link, and it's soooo slow. half of the pictures doesn't even load, this goes for the threads also.

[mlee49]

I saw some preformance time outs yesterday, but that was very brief and havnt seen anything like that again.

Maybe the server was refreshing?

[NastyHabits]

Down for me in Oakland, CA. Tracert only proves you can get to the server. It might be problems with the software on the server itself. Probably needs a reboot. ;)

[TheMailMan78]

Same here. The only way I can get to TPU is via Safari 3 on my old Apple laptop. My PC which is on the same network wont connect. I even downloaded Firefox out of curiosity and still no luck. I suspect Dan and his sheep concubines have something to do with this.

[thebluebumblebee]

count me in. I've been unable to connect for hours.

[aCid888*]

Down in Montreal....at least the forums work though

[Soylent Joe]

Time for TPU's annual tube cleanout. Just spray some scrubbin bubbles, wipe it off, shove a little tube lube up in there and it'll be good as new.

[TheMailMan78]

Its amazing we all can't connect yet we are still posting. Our TPU addiction has become an hallucinogenic.

Time for TPU's annual tube cleanout. Just spray some scrubbin bubbles, wipe it off, shove a little tube lube up in there and it'll be good as new.

I'm thinking W1zz had to skip paying the bill this month to get Dan back from the local pimp. You know hooker debt.

[Triprift]

Im having the same prob will be saving to forums in favorites as a backup.

[BUCK NASTY]

Same problem here in Florida. Also could not connect thru company servers in New Jersey from work this afternoon.

[A Cheese Danish]

Seems to be working fine for me...?

[Triprift]

Seems to take forever to load pages fully as well for me have to keep pressing stop as its annoying how long its taking.

[[I.R.A]_FBi]

my page wont fully load

[A Cheese Danish]

Seems to take forever to load pages fully as well for me have to keep pressing stop as its annoying how long its taking.

_FBi;1436488']my page wont fully load

Just noticed that as well. Some times the TPU logo won't load. Takes forever to refresh,
But I can navigate through the site like I always could.

[Triprift]

Same as me fbi never seen tpu like this hopefully its only temporary. =/

[NastyHabits]

Arrggghhh! TPU withdrawal. I'm getting the shakes.

[95Viper]

_FBi;1436488']my page wont fully load

Ditto...

And, Front page is hosed. I get it, but the format is shot. Like no frames.

[mastrdrver]

Add me to the list.

It half loads the front page but never changes the screen. I can get to the forum and everything seems to load fine. The browser just gets sits in a continual loading of the last bit though I can cruise through the forum just fine.

[mlee49]

For those that miss the front page:

http://img.techpowerup.org/090617/Capture051.jpg

I'll update every minute to subside your worries :p

[CrackerJack]

i get this alot
http://img.techpowerup.org/090617/tpu.jpg

[Triprift]

I havnt even tried hopefully when got home from my arvo shift everything will be sweet.

[HammerON]

Yep ~ having troubles:(
No problem accessing foums though:)

[mrw1986]

Having the same issue as erocker here.

[Steevo]

i am having issues as well, site is horribly slow.

[Wile E]

It seems to be only the image portion of the server that I'm having issues with.

[Kursah]

Same here, it's getting worse and worse...hopefully all is good tomorrow. I'm sure there's a reason for it, I'm not too worried. I agree with Wile E it only seems to be images that are affecting me too.

[Triprift]

Lol maybe we will be setting up a tent city at GN. :p

[stefanels]

Same issues here... :(

[ShadowFold]

Now all the images don't load :(

[OnBoard]

Aaah, forums, why didn't I think of that earlier. I got nothing out of front page for hours. Now it loaded without any pictures or css.

Anyhow, forums keep my addiction down ^_^ (better do non graphic smilies)

For those that miss the front page:

http://img.techpowerup.org/090617/Capture051.jpg

I'll update every minute to subside your worries :p

Thanks :)

[Steevo]

Probably a DDOS slowing down the servers

[Triprift]

At this rate the whole place will scream to a halt in half an hour.

[OnBoard]

btw. those Audio-Technica headphones image didn't show up yeasterday at all. Wondered why there was no picture, saw it first time on the mlee49 screenshot. NZXT Beta case picture however worked when that review was posted later.

edit: was blocked as an AD, not related :)

[FordGT90Concept]

Right now, I'm having problems accessing any of the images on http://img.techpowerup.com which includes the quote, reply, header images, etc. It has been trying for the last five-ten minutes to no avail (42 items remaining as I type this). All the other subdomains are working fine.

[t77snapshot]

Having trouble here too :(

[mlee49]

Oh hell, things are getting ugly here for me. Icons not showing up, images not being displayed, frantic posting getting my blood pressure up.

I'm just going to chug a 5th of Vodka and pass out for a few hours.

[MRCL]

Having trouble here too :(

Even here its not working properly. I need to quote to even be able to post.

[boomstik360]

Yeah its not loading any pics on here and tpu home wont load :( weird

[sweeper]

half the site is gone.... wiped away.... vanished! :eek:

[FordGT90Concept]

1 hour later and the problem is still present: very few images on the img.techpowerup.com subdomain are showing. The subdomain clearly isn't down but requests aren't being fulfilled (35 items remaining right now).

Even here its not working properly. I need to quote to even be able to post.
You can hover over where the buttons should be to see the alt text. It gives a pretty good indication as to what your mouse is pointing at.

[Assassin48]

could it be the same thing that happened at xs ?

[From_Nowhere]

I'm having the same issue. TPU takes forever to load, roughly 20 minutes, but the Forums and Generalnonsense.net load ok. Although some of the stuff on the TPU Forums is in text where it used to be icons like the Thanks, Multi-Quote, People's online status under their avatar icons.

[FordGT90Concept]

Eh? XS is having problems with image hosting too? I don't know how they would be connected unless they are hosted on the same servers or same network. I doubt someone could be DOSing two major sites simutaneously.

[Assassin48]

no it happened a while back

[FordGT90Concept]

In that case, it could be a similar attack perhaps for similar reasons. There may be a connection but I am in no position to judge. Someone that has access to the servers at TPU will figure out the cause and fix it.

I should note that the HTML side of things off forums.techpowerup.com is responsive as normal/expected. img.techpowerup.org is also uneffected.

The issue started at almost exactly 00:00 CST 6/18/2009.

[Assassin48]

its perfect on the ps3 web browser

[MRCL]

1 hour later and the problem is still present: very few images on the img.techpowerup.com subdomain are showing. The subdomain clearly isn't down but requests aren't being fulfilled (35 items remaining right now).


You can hover over where the buttons should be to see the alt text. It gives a pretty good indication as to what your mouse is pointing at.

Yes that works I know, I ment that I need to use the quote function to post, as the normal text field is not visible.

I hope its not the intro of a mega-down like XS had. Navigation thru the forums works rather quick, altho without any images...

Its 8:21 here, so its likely W1zz is not even up yet *laughing smilie here*

[beyond_amusia]

issues in nebraska - i just delt with my old roommate ripping my DSL line out of the box last night and waited for the ISP to repair it all day... and now thing =( things are extremely slow - as i type, MRCL's sig just rendered. Is there another TPU server us US users can log into (EU? Asia?) for better speed ect?

[enaher]

here in latin america as well:cry:

[FordGT90Concept]

My server (doesn't have anything cached) takes about a minute to pull up www.techpowerup.com. It only loads the HTML with little else (no CSS or IMG).

Pings to techpowerup.com are about 55ms with 0% loss.

[Flyordie]

Yeah, W1zzard, I am sorry for your troubles... lol. Good luck fixing TPU. ;-)

[W1zzard]

image server restarted. seems to work now

[boomstik360]

image server restarted. seems to work now

Awsome thanks! :toast:

[Mussels]

i was just trying to get hold of you in MSN w1zz, to mention this... seems to be working now.

[W1zzard]

hrmmm "kernel: Out of socket memory" .. i think i have to reboot the whole machine

edit: seems to be caused by the daemon being restarted.. waiting some more before rebooting

[HammerON]

image server restarted. seems to work now

TPU homepage running again:)

Thanks W1zzard!

[MRCL]

Yep, works perfectly fine now :). My morning is saved after all.

[Triprift]

Great working fine now thanks Wizz.

[Velvet Wafer]

had this problem for 3 minutes, 5 minutes ago... reseating of my wlan-stick somehow fixed it^^

or im just a moron, i know

[Mussels]

had this problem for 3 minutes, 5 minutes ago... reseating of my wlan-stick somehow fixed it^^

or im just a moron, i know

dont worry, i reset 4 switches, a router, a smoothwall, and my PC before realizing it was TPU that was down. by then, w1zz had fixed it.

[Triprift]

Lol someone got a bit paranoid :p

[Mussels]

Lol someone got a bit paranoid :p

my internets wasnt working, it HAD to be fixed :P

[Velvet Wafer]

you speak truly, without internet-acess im somehow crippled^^

[MRCL]

Kudos to TPU for being down, yet reachable :P Impressive how many people still posted here :laugh:

[mastrdrver]

Impressive how many people still posted here :laugh:

See following thread for more detail: http://forums.techpowerup.com/showthread.php?t=95995

:laugh:

[Flyordie]

"connection was reset"
1 1 ms <1 ms 1 ms 192.168.0.1
2 11 ms 14 ms 9 ms ip-69-27-219-1.marktwain.net [69.27.219.1]
3 * * * Request timed out.
4 * * ^C

Idk whats causing it exactly but will be working with my ISP to solve it if its their end... (which I doubt it is, since I can access any other site while that happens...)

[Assassin48]

i keep getting timed out too

[Mussels]

TPU has the odd drop out lately, but nothing like the big one this thread was about. everythings been working fine 99% of the time for the last few days.

[W1zzard]

from midnight server time till about 2 am today and yesterday there were some problems with the server. looking into what's causing it

edit: problem solved, someone thought he should download a single page 2500 times. ip banned, isp notified

[TheMailMan78]

edit: problem solved, someone thought he should download a single page 2500 times. ip banned, isp notified How and why would you DL a page that many times?

[Mussels]

from midnight server time till about 2 am today and yesterday there were some problems with the server. looking into what's causing it

edit: problem solved, someone thought he should download a single page 2500 times. ip banned, isp notified

.... wtf?

[Steevo]

In Soviet Russia his website downloads YOU!

[W1zzard]

just wait till i make a botnet out of running gpu-z versions and flood that guy, his isp and his upstream isp :P

[TheMailMan78]

just wait till i make a botnet out of running gpu-z versions and flood that guy, his isp and his upstream isp :P

WTF happen man? Details!

[Steevo]

We are all under the power of the W1zzard of the north. We are his evil minions. We shall do his bidding.

[MRCL]

We are all under the power of the W1zzard of the north. We are his evil minions. We shall do his bidding.

Not me, I live in a neutral country, you can do NOTHING:laugh:

[TheMailMan78]

Not me, I live in a neutral country, you can do NOTHING:laugh:

When we stop through your country in hunt of the haxor know this.....

Dibs on MRCLs house! :laugh:

[Triprift]

And were to isolated in Oz cant get us lol.

[MRCL]

When we stop through your country in hunt of the haxor know this.....

Dibs on MRCLs house! :laugh:

My army of cows and Fondue-Cannons are awaiting you.

[TheMailMan78]

My army of cows and Fondue-Cannons are awaiting you.

I look forward to going postal on your cows.

[Mussels]

the great firewall of australia will keep them out. we're safe trip.

[mastrdrver]

edit: problem solved, someone thought he should download a single page 2500 times. ip banned, isp notified

How and why would you DL a page that many times?

In Soviet Russia his website downloads YOU!

:roll:

Go minions and do his bidding. :rockout:

[W1zzard]

WTF happen man? Details!

nothing interesting really .. i noticed that the tpu web server process kept restarting itself (hang detection script) from 00:00 to 02:00 yesterday and today. so i looked at the logs, found a dude who kept downloading a certain page very very often which causes high load on the server, banned his ip, notified his isp, done

[boomstik360]

Did anyone else just have connection issues too? Like a couple min ago?

[W1zzard]

confirmed. will take a look at the logs

edit: ddos from a chinese botnet using slowloris attack

[TheMailMan78]

confirmed. will take a look at the logs

edit: ddos from a chinese botnet using slowloris attack

Why is TPU being attacked so much? What the hell is going on??

[Mussels]

Why is TPU being attacked so much? What the hell is going on??

someone who got banned, thinking he has leet haxor skills?

[TheMailMan78]

Well I'm American. Ill round up a TPU posse and we will hunt the vermin down. Ill need members of the hit squad.

[Triprift]

Lol i think theyd just take one look at your avvy and run a mile MailMan. :p

[Flyordie]

Gahh! Its retaliation from the Earth Day Cyber Attack a US based Botnet did on China... (we won, brought down alot of their stuff for 2-6hrs.)

[[I.R.A]_FBi]

1 couldnt get on tpu for .5 hr a while ago

[boomstik360]

Yep same here... Something weird has been going on lately

[A Cheese Danish]

Yeah, it cut out on me twice within the last 2 hours. Same with GNF.

[HammerON]

We are being taken over :cry:
Really this is getting annoying :banghead:

[t77snapshot]

I couldn't view the next post ahhhhhhh I NEED you TPU:respect:

[boomstik360]

Yeah it been happening every single day lol....

[MRCL]

So it wasn't just me then lol. I was almost freaking out. Sunday morning, no TPU? Thats the fifth of the Horsemen of the Apocalypse.

[HammerON]

Just happened again :mad:
WTF

[boomstik360]

Yep, this is uber lame lol :cry:

[MRCL]

Its sunday 8:30am ON A SUNDAY who attacks a website at this time seriously.

[A Cheese Danish]

Well, it's 2:30 AM here, and idk if someone is attacking it or what, but I messaged W1z on aim about it, and he never got
back to me :(

[MRCL]

Well, it's 2:30 AM here, and idk if someone is attacking it or what, but I messaged W1z on aim about it, and he never got
back to me :(

I assume he is sleeping in like everybody else in this time zone. Except me of course. I am at work. Great, no?

[A Cheese Danish]

I assume he is sleeping in like everybody else in this time zone. Except me of course. I am at work. Great, no?

Idk. He is still on aim right now. But he isn't on here...Don't know where he is. Or he's just ignoring me...
Yeah, time zones can be pretty lame

[Mussels]

w1zz hardly ever replies, even to me (and i'm a mod)

just because he doesnt reply, doesnt mean he wont read the message when he gets back to his PC.

[W1zzard]

i read this when coming home around 8 am but wasnt in a state to do anything. now i woke up and it's the first thing i do

[W1zzard]

epic fail me. changed the firewall configuration, made a typo, network interface got blocked, locked myself out.. but fixed now

[MRCL]

epic fail me. changed the firewall configuration, made a typo, network interface got blocked, locked myself out.. but fixed now

Lol even the Mighty are not perfect.

Maybe I should download TPU a couple of dozen times to bridge those inaccessible times... j/k :laugh:

[Triprift]

I coudnt get in a little while a go all fun and games here. =/

[FreedomEclipse]

I had to refresh my link to the main page about 5 times before it worked. I thought maybe TPU was down for maitenance & i missed the announcement

[InnocentCriminal]

Just shows you how much we're all addicted to TPU.

[Triprift]

Indeed im was like great cant get into TPU what about GN no great no net ahhhhhhhhhhhh lol.

[boomstik360]

Problems again...

[[I.R.A]_FBi]

couldnt get on for 5 mins a while ago

[W1zzard]

_FBi;1451794']couldnt get on for 5 mins a while ago

you got a 403 permission denied error ? i'm tweaking some anti-DOS settings and need to find the right balance between too strict and too relaxed. we have SO much stuff running here, for example that live topic thing on the forum looked like a DOS attack to the script.. it kept refreshing the same page over and over again every few seconds

[boomstik360]

Craziness man :twitch:

[[I.R.A]_FBi]

you got a 403 permission denied error ? i'm tweaking some anti-DOS settings and need to find the right balance between too strict and too relaxed. we have SO much stuff running here, for example that live topic thing on the forum looked like a DOS attack to the script.. it kept refreshing the same page over and over again every few seconds

I didnt look to see what error

[W1zzard]

can someone with a fast US based connection try to spam click on the arrows of the reviews thingie on the frontpage to check if there is some kind of problem or not

[Mussels]

can someone with a fast US based connection try to spam click on the arrows of the reviews thingie on the frontpage to check if there is some kind of problem or not

i'm not US, but i've got a 10Mb - i'll give it a shot.


EVENTUALLY i got a 403 - after oh.... trying to load 40 of em at once :)

[W1zzard]

EVENTUALLY i got a 403 - after oh.... trying to load 40 of em at once :)

so the question is, should this be treated as a "DOS" or somehow go through?

[Assassin48]

so the question is, should this be treated as a "DOS" or somehow go through?

i am in the us
want me to give it a shot?

[Mussels]

so the question is, should this be treated as a "DOS" or somehow go through?

to be honest, if someone clicks that next button for a minute straight like i did, they arent doing it looking for reviews. i was clicking so fast it didnt have time for the images to load.

IMO, block it. something that excessive is... well, excessive.

[W1zzard]

i am in the us
want me to give it a shot?

sure

[Assassin48]

i kept clicking it now nothing shows up
http://img33.imageshack.us/img33/3928/testyul.png

[TheMailMan78]

can someone with a fast US based connection try to spam click on the arrows of the reviews thingie on the frontpage to check if there is some kind of problem or not

I just gave it a try and nothing came up. No error at all. It just kept reloading.

Edit: I just got this....

Forbidden
You don't have permission to access /index.php on this server.


--------------------------------------------------------------------------------

Apache/2.2.8 (Fedora) Server at www.techpowerup.com Port 80

[MRCL]

Edit: I just got this....

Tried it out of interest too, same result.

[Laurijan]

Had a connetivity issue just moments ago for several minutes

Edit: and i had several of these when swithing pages but after several tried it loaded the page
http://img.techpowerup.org/090630/tpu.jpg

[AsRock]

Had a connetivity issue just moments ago for several minutes

Edit: and i had several of these when swithing pages but after several tried it loaded the page
http://img.techpowerup.org/090630/tpu.jpg


Same here too. And it just did it again too.

[Flyordie]

same.

[boomstik360]

yep

[t77snapshot]

Nooo not again:cry: Whats going on TPU?

[erocker]

Everyday, same time for about 3-5 minutes. Not a big deal for me really.

[boomstik360]

Everyday, same time for about 3-5 minutes. Not a big deal for me really.

Yeah its no biggy.

[t77snapshot]

Ok....:o sorry to fly off the handle like that, hehehhee:D

[boomstik360]

Lol its alright, I have just gotten used to it.

[HammerON]

It isn't a big deal; but it still SUCKS :(

[W1zzard]

i know it sucks but still havent luck blocking those attacks

[HammerON]

i know it sucks but still havent luck blocking those attacks

Thanks Wiz ~ keep trying :toast:

[human_error]

Happened for me a couple of mins ago - no access to forums or TPU homepage due to timeouts (only lasted a couple of mins). I'm amazed this doesn't happen more often tbh, tpu is one of the most reliable sites out there.

[Laurijan]

Happened for me a couple of mins ago - no access to forums or TPU homepage due to timeouts (only lasted a couple of mins). I'm amazed this doesn't happen more often tbh, tpu is one of the most reliable sites out there.

GeneralNonesense.net was also affected

[W1zzard]

they are both on the same server. blocked a large number of chinese ips, let's hope it's better tomorrow

[Steevo]

When I used to rum my FTP I had to block large parts of china's subdomains as it was taking up all 50 connections.

[Mussels]

i get constant worm attacks from chinese IP's, kaspersky automatically blocks them, thankfully.


if these attacks are downloading the site, maybe its possible to ID them? I know browsers report what they are to the server, if all these attacks are using hte same code (IE6, for example) you could just block that browser with a page saying to update.

[W1zzard]

114.104.19.209 - - [27/Jun/2009:00:49:23 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:23 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:23 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:24 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:24 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:24 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:25 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:26 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:26 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:27 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:31 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:31 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:33 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"
114.104.19.209 - - [27/Jun/2009:00:49:33 -0500] "GET /downloads/821j/nfsps_pcdemo.exe HTTP/1.1" 302 - "http://www.techpowerup.com/downloads/821/mirrors.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 3.5.20706)"


no way to block other than by ip or request access pattern. blocking by access pattern seems to be quite difficult with apache and most other web servers/proxies, at least you can't make complex rules.

can't block all ie 6 from all ips. that would lock out a large number of visitors, me included.

[Mussels]

i notice thats from the download server, limit the downloads to 3 downloads at a time per IP, or make the large files accesible only to people with a forum account?

Sure its not what you want to do, but if it solves this issue, its a necessity.

[Steevo]

NetRange: 114.0.0.0 - 114.255.255.255


Block it.

[W1zzard]

i notice thats from the download server, limit the downloads to 3 downloads at a time per IP, or make the large files accesible only to people with a forum account?

Sure its not what you want to do, but if it solves this issue, its a necessity.

that url sends back a http redirect header sending you to another server. the attackers dont follow that redirect and dont download the file. the actual downloads are not served from the tpu webserver.

3 conns per ip breaks a lot of site features and all people coming from behind a proxy

[Mussels]

that url sends back a http redirect header sending you to another server. the attackers dont follow that redirect and dont download the file. the actual downloads are not served from the tpu webserver.

3 conns per ip breaks a lot of site features and all people coming from behind a proxy

hmm. unfortunately i'm not educated enough in this to come up with any specific solutions.

automatic bans for users that make more than x connections that expire after 30 minutes? something like that possible? it means that there would be a brief spike when they start, and then it would stop til they ran another proxy.

[W1zzard]

NetRange: 114.0.0.0 - 114.255.255.255


Block it.

that was just a sample log except, there a lot of different ips from all kinds of subnets from all over asia. blocking a class A subnet = bad idea, lots of innocent people use those ips, its like dosing yourself, people cant reach your site because of the ip block

[W1zzard]

automatic bans for users that make more than x connections that expire after 30 minutes? something like that possible? it means that there would be a brief spike when they start, and then it would stop til they ran another proxy.

they are using a lot of host to connect at the same time

more than x after 30 means 30 minutes downtime and bans people using the forum live thread thingie which also polls a single url once every 3 (i think) seconds

[Mussels]

gah, complicated.

[Wile E]

Definitely complicated. Either way w1z, it's not a huge deal to lose the forum for 5 minutes a night from my perspective as a user, but nonetheless, we wish you the best in getting it sorted.

I wish I knew more about it, and could offer some help.

Are there plugins for apache to help in this issue? You aren't the only one suffering from problems of this nature. Surely somebody has to have written a good script or plugin for issues just like this.

[TheMailMan78]

W1zz I wish I could help. I would in a second. All I can offer is this....

http://greatwhitedelight.ca/wp-content/uploads/scottra1.jpg

And some mad photoshop skills.

[W1zzard]

Are there plugins for apache to help in this issue? You aren't the only one suffering from problems of this nature. Surely somebody has to have written a good script or plugin for issues just like this.

i havent found anything that's good enough. there are some apache modules but they are quite basic and demand too many compromises imo. there are corporations of course that specialize in ddos protection for a modest fee starting at several thousand dollars a month

[Steevo]

China doesn't need TPU does it?


Seems more like this is the sniffing leading up to the attack, testing the waters so to speak. You have anyone that doesn't like you W1zz? A forum I used to mod was taken down one night by some peeps who didn't like some of the mod squad.

[W1zzard]

China doesn't need TPU does it?


Seems more like this is the sniffing leading up to the attack, testing the waters so to speak. You have anyone that doesn't like you W1zz? A forum I used to mod was taken down one night by some peeps who didn't like some of the mod squad.

no idea. i have no personal issues with anyone. however there are definitely a couple of forum users who were banned and are unhappy with it

[Mussels]

no idea. i have no personal issues with anyone. however there are definitely a couple of forum users who were banned and are unhappy with it

to add to that, i myself have a program i found at a LAN specifically designed to attack and crash PC's and web servers. it has TCP, UDP and HTTP based attacks - and it sure as hell BSOD'd regular PC's... no idea what it could do to a web server.

This doesnt need to be some awesome group of hackers, it can be one pissed off dude with fast internet and a single .exe file he found online.

[W1zzard]

simple tcp/udp attacks will crash your (sending) windows machine long before anything happens to tpu's server. http attacks are different though, quite a bunch can be filtered out easily. the hard ones are the ones that mimic user behaviour

[Mussels]

i suppose its just finding the effect a normal user has on the site (refreshes/accesses a second) and then blocking anything thats say 200% higher than that. (leaving room for two users on one IP, for example)

[Steevo]

Are you filtering source routed IP's?

[W1zzard]

yes and probably every upstream router on the way

[Steevo]

No actually, many do not filter source routed IP's as it is essential for some Radius type servers.


Do you have IP's by block hitting you or random?

[W1zzard]

ya, i got
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1

wrote a little shell script to identify evil attackers in the future:

grep -mmap "`date -d yesterday +%d/%b/%Y`" www.techpowerup.com_access_log | \
awk '{print $1, $7}' | \
grep "10.12.xx" --invert-match | grep "74.86.xx" --invert-match | \
sort | uniq -c -d | sort -n -r | head -n 50

<3 the unix shell.. gives me top ips accessing the same url repeatedly over a day sorted by hit count

can you believe a certain forum spammer tried to register 245 times on the forums today....

[Steevo]

Add a kick ban with XX time limit to the top level.

[Mussels]

TPU has gone to poop for me, had to load 30 odd email links to the forums (not all at once) and kept getting blank pages, or avatars not loading.

[OnBoard]

I haven't had any issues since the 17.6. attack. Have to try tomorrow morning at the time these previous reports are, what's the fuss about :)

[Steevo]

403 last night, and then some connections not available from IE8 (dont gimme no shit)

[FreedomEclipse]

China doesn't need TPU does it?

as much as i sympathise with whats going on (ive been blocked out once myself) If you block China from visting the server I wont be able log on when i go visit family in Hong Kong :( which means Id have to join the 'attackers' by adopting the use of a Proxy which even then i may get accidently 'nuked' by wizzy on his nuking/bann hammer spree.

Do not want!!!

[W1zzard]

dont worry, we're not going to block any large ip ranges, at maximum a class C subnet

[Solaris17]

Well I'm American. Ill round up a TPU posse and we will hunt the vermin down. Ill need members of the hit squad.

Game time. lets go.


*starts playing "surfing bird" and smoking a cigg while carrying automatoc weapon*

[Wile E]

Game time. lets go.


*starts playing "surfing bird" and smoking a cigg while carrying automatoc weapon*

Well the bird, bird, bird, the bird is the word!

[Solaris17]

Well the bird, bird, bird, the bird is the word!

lol!!!! mumma o maw maw mumma o maw maw



thats how we defeat hackers. .762mm full metal jacket.

[Mussels]

lol!!!! mumma o maw maw mumma o maw maw



thats how we defeat hackers. .762mm full metal jacket.

thats one tiny bullet. *borrows his brothers 8mm mauser*

[Solaris17]

thats one tiny bullet. *borrows his brothers 8mm mauser*

lol i think i put the "." in the wrong spot...thats why i dont use punctuation lol good stuff boys get the shermins were gonna get us some spl0it3r!!

[HammerON]

Well the bird, bird, bird, the bird is the word!

Nice! Love that song:)

[TheMailMan78]

thats one tiny bullet. *borrows his brothers 8mm mauser*

Its not the size son. Its the placement. ;)

[NastyHabits]

Its not the size son. Its the placement. ;)

Sometimes it's the size. A 458 Winchester Magnum hits with over 3 tons of force. Ted Nugent used one to put down a cape buffalo he had wounded while hunting it with a bow and arrow. It charged him from inside a cane brake at less than 30 feet. To quote Ted, "It was like hitting a baby with a ball peen hammer."

[FordGT90Concept]

Its not the size son. Its the placement. ;)
0.762mm would have less mass than a BB. It would really only do a lot of damage if it hit the eye or other "soft tissue." Then again, the wind might make it completely miss.

Unless it was made of depleted uranium. :eek:


On topic, it seems GN.net is starting to get more hiccups too. :(

[TheMailMan78]

0.762mm would have less mass than a BB. It would really only do a lot of damage if it hit the eye or other "soft tissue." Then again, the wind might make it completely miss.

Unless it was made of depleted uranium. :eek:


On topic, it seems GN.net is starting to get more hiccups too. :(

I think he meant 7.62mm. Anyway I think you guys are looking WAY to far into this stupidity.

[Triprift]

There on the same server so im not suprised gn has the odd probs.

[A Cheese Danish]

So yeah, TPU cut out again for a brief few minutes. Not too sure what the point of that was.

[Triprift]

TPU and gn are slow atm for me and pages not displaying ect. =/

[FordGT90Concept]

I could get on GN.net fine but not TPU. I go to the URL and, without displaying anything, it just said "Done."

[Triprift]

Dont know about any else but tpu seems to be bad atm pages not loading third time in the site tonight =/

[MRCL]

Dont know about any else but tpu seems to be bad atm pages not loading third time in the site tonight =/

Just noticed that, too. Works fine now tho.

[Mussels]

its going a bit crap here too.

[MRCL]

I take it back, TPU as well as GN were inaccessible for a few minutes. Was that this chinese guy lol.

[Flyordie]

Midwest, USA for me- Also stopped loading for a few minutes

[Mussels]

I take it back, TPU as well as GN were inaccessible for a few minutes. Was that this chinese guy lol.

funny if it was.


TPU has an autoamted system to counter this stuff now anyway, drops off for a minute, then as those IP's get banned it starts to work again.

[Flyordie]

Yep... my system has that setup also.. cept its a wee bit faster since I have 1 CPU core setup to do all the networking stuff... the other 7 are general use for server needs. (2x Quad Barcelona's) Soon to be 2x Istanbul HE's that I am supposed to torture to death... and write a full report to AMD on.... *cries* Anyway... hope they stop attacking... what a waste of bandwidth...

[W1zzard]

getting hit bad by ddos now .. no automated ip banning yet .. and i should be gone to watch brüno

[Mussels]

getting hit bad by ddos now .. no automated ip banning yet .. and i should be gone to watch brüno

:(

you sir, need that automated system up and running.

[DrPepper]

Temporary fix until then, full scale nuclear war. On topic though I have had like 1-2 minutes of no access to TPU though no problem though.

http://img.techpowerup.org/090715/Capture020.jpg

[Flyordie]

getting hit bad by ddos now .. no automated ip banning yet .. and i should be gone to watch brüno

BRUNO! BRUNO! BRUNO!
Anyway... take your time, im at work anyway as well as most of you others... :laugh:

[btarunr]

I take it back, TPU as well as GN were inaccessible for a few minutes. Was that this chinese guy lol.

If that guy had the brains to harm TPU, he would have enough of it to know what the topic was, and what was actually being discussed.

[W1zzard]

:(

you sir, need that automated system up and running.

tell me how to ban a host via iptables and let that ban expire after a certain amount of time so the amount of entries in iptables doesnt overload the system

[Mussels]

tell me how to ban a host via iptables and let that ban expire after a certain amount of time so the amount of entries in iptables doesnt overload the system

oh thats easy, you click the infraction button, set the points to 25 and "expires" to 1 day...

(you should know by now that my programming skills end at PHP codes)

[TheMailMan78]

Temporary fix until then, full scale nuclear war. On topic though I have had like 1-2 minutes of no access to TPU though no problem though.

http://img.techpowerup.org/090715/Capture020.jpg

That would make an awesome desktop!

Anyway on topic. I couldn't connect just now for about 10 minutes. 11:49 est.

[btarunr]

No connectivity for the past ~30 minutes here. Then again, I'm +12 hours from US Central Time, so I'm exactly on the other side of the globe from TPU's servers.

[Mike0409]

Temporary fix until then, full scale nuclear war. On topic though I have had like 1-2 minutes of no access to TPU though no problem though.

http://img.techpowerup.org/090715/Capture020.jpg

First off that is freaking a sweet Picture..I gotta admit. :D What the hell is that from?



2ndly Im too having issues connecting at random times 12:05PM EST.

DDOS attack's eh? TPU pissed off North Korea? Kim Jong Ill must of realized us as a threat...


Hey Wizz, is it possible to maybe redirect TPU to a backup block of IP's? If the dos attack is nailing just the TPU address having TPU linked to another IP address could delay it for a bit.

[FreedomEclipse]

the sites still getting hit... I couldnt access around 11am/12pm (GMT) & the same again just 30seconds ago.... anyone got this chinese guys address?? I could send a few of my cousins over for a 'chat' with this guy

[btarunr]

DDOS attack's eh? TPU pissed off North Korea? Kim Jong Ill must of realized us as a threat...

Yes, all their phone-lines are dedicated to the 56 kbps modems that are making this happen.

[Mike0409]

Yes, all their phone-lines are dedicated to the 56 kbps modems that are making this happen.

Hey now, don't mock it.

http://news.yahoo.com/s/ap/20090708/ap_on_re_as/as_skorea_cyber_attack :toast:

[MoonPig]

I'm getting issues too :(

[FreedomEclipse]

Omg....site blanked out again -_____-

[btarunr]

Hey now, don't mock it.

http://news.yahoo.com/s/ap/20090708/ap_on_re_as/as_skorea_cyber_attack :toast:

I'm not. Recent DDOS attacks have been from China.

[TheMailMan78]

W1zz this might be extreme but could you block all ISPs from China for a while? Kinda make TPU drop off the map from China. Out of site out of mind. See what I did there ;)

Just something temporary. I would hate to lose any of our legitimate members like FreedomEclipse.

Edit: Why are people from China hitting TPU so hard with DDOS? I mean we don't have anything financial on here.

[hat]

If that guy had the brains to harm TPU, he would have enough of it to know what the topic was, and what was actually being discussed.

Naw... propaganda agent

[btarunr]

Naw... propaganda agent

Every jingoist doesn't have to be a propaganda agent. They have them at much higher levels.

[FreedomEclipse]

I would hate to lose any of our legitimate members like FreedomEclipse.

Im not actually based in china ^_^ so its ok.

[TheMailMan78]

Im not actually based in china ^_^ so its ok.

Yeah I know but you said you traveled back and forth. The whole batch shouldn't suffer because of a few bad eggs. That and I love Asian women. :rockout:

[Steevo]

tell me how to ban a host via iptables and let that ban expire after a certain amount of time so the amount of entries in iptables doesnt overload the system


http://www.netadmintools.com/art131.html


generate a list of connections every minute, and filter to the top 10 and if more than XXX then copy value (ip address) and run it to ban the host, and have a autoreset set to run every five minutes or whatever time interval.

[hat]

Every jingoist doesn't have to be a propaganda agent. They have them at much higher levels.

It sounded like a lot of propaganda bullshit to me. I know this doesn't really go to proving my suspicions of him being a propaganda agnent, but he (very poorly) tried to hide his true identity, saying he was from australia, yet every time he mentioned China he said "us".

[AsRock]

Been getting connections then no connection at all with TPU for 5-30 mins a time. Been terrible today.

[btarunr]

It sounded like a lot of propaganda bullshit to me. I know this doesn't really go to proving my suspicions of him being a propaganda agnent, but he (very poorly) tried to hide his true identity, saying he was from australia, yet every time he mentioned China he said "us".

Which again, is plain jingoism. When Yankee and Red Sox fans quarrel, you have the same "us", "we", "pwn", etc. flying around.

[TheMailMan78]

Which again, is plain jingoism. When Yankee and Red Sox fans quarrel, you have the same "us", "we", "pwn", etc. flying around.

Would you mind enlighten me as to WTF you guys are talking about? :twitch:

[btarunr]

Would you mind enlighten me as to WTF you guys are talking about? :twitch:

This: http://forums.techpowerup.com/showthread.php?t=99277
read it completely
they suspect that guy is behind the ddos. :ohwell:

[Solaris17]

This: http://forums.techpowerup.com/showthread.php?t=99277
read it completely
they suspect that guy is behind the ddos. :ohwell:

well if he lives in aus arent we looking at the wrong IP range?

[dr emulator (madmax)]

This: http://forums.techpowerup.com/showthread.php?t=99277
read it completely
they suspect that guy is behind the ddos. :ohwell:

hm the last time i said something about chinnese people i was called a racist ha ha me a racist :laugh::roll::laugh:
oh well must bide my time before the takeover how much was it again $238783 do you take pennys :laugh:

[btarunr]

I don't attach much importance to that guy. W1zzard can see people from which IP addresses are acting funny, and make their smiles fade. Rest assured.

[TheMailMan78]

I don't attach much importance to that guy. W1zzard can see people from which IP addresses are acting funny, and make their smiles fade. Rest assured.

I agree. That guy was to dumb to be staging a DDOS. If he did I would be surprised. I wish I would have caught that him. I would have had a field day with him :laugh:

[W1zzard]

http://www.netadmintools.com/art131.html


generate a list of connections every minute, and filter to the top 10 and if more than XXX then copy value (ip address) and run it to ban the host, and have a autoreset set to run every five minutes or whatever time interval.

the evil chinese dont open multiple connections at the same time

[dr emulator (madmax)]

joking aside i couldn't see the pics on some of the case reviews earlier:eek: :mad:
beleive me i was fuming around the edges :mad:
as for said country which i shall not name for legal reasons
i get it now they want tpu to fail so they can buy it up for a really cheap price
then they have no competition:shadedshu
well i say forget it buddy it aint going to happen :mad:keep ya paws off
still it would be hard to ban so many ip addresses from said area of the world
as they make the modems and software that can virtually clone anyone

[TheMailMan78]

the evil chinese dont open multiple connections at the same time

So can you do the ISP thing I recommended?

[W1zzard]

at least i'm getting a free learning experience in ddos mitigation .. other people play top dollar for that

[Steevo]

the evil chinese dont open multiple connections at the same time

Top level domain........

[W1zzard]

so you mean 10 concurrent connections per .com / .net / .org / .cn ?

i dont think that's gonna work .. plus doing a name lookup for every ip is very costly. besides not all chinese ips have .cn

[Steevo]

Who said that? Are these other sites, or just bots?


If they were bots then use a 75.171.253.* for me if I were part of the problem.


Can you PM me or post some of the logs? Perhaps that would lend understanding.

[W1zzard]

i ended up writing my own ddos mitigation software .. things are looking good for now. let me know if the site bans you while doing legitimate stuff

[TheMailMan78]

i ended up writing my own ddos mitigation software .. things are looking good for now. let me know if the site bans you while doing legitimate stuff

Can you name this software "TheMailMan"? TMM for short?

[DrPepper]

That would be better for an email client :p

[TheMailMan78]

Hey I just got this error.

http://forums.techpowerup.com/attachment.php?attachmentid=27462&d=1248967084

[FordGT90Concept]

Wizzard was playing with the source force. :laugh:

[Mussels]

w1zz was modding some stuff with quotes in sigs, may have had some civilian casualties

[Arrakis+9]

seem to be getting connectivity issues 10pm GMT -6 none of the pictures are loading and the pages loading very slowly... ?

[FreedomEclipse]

seem to be getting connectivity issues 10pm GMT -6 none of the pictures are loading and the pages loading very slowly... ?

yep - getting the same issues here

[Wile E]

seem to be getting connectivity issues 10pm GMT -6 none of the pictures are loading and the pages loading very slowly... ?

yep - getting the same issues here

Thirded

[Mussels]

same here - i was blaming my housemates downloading.

http://img.techpowerup.org/090730/Capture008470.jpg


For reference, you can see many pics are text and not images.


http://img.techpowerup.org/090730/Capture009703.jpg

Same here

[fullinfusion]

started for me @ 10:00pm -6 gmt central