TPU Connectivity Issue. 6/17/09

[Nick89]

Maby the image server had a power fault of some kind.

Also thanks to whoever made my sig better.

Thank you W1zz.

 

[Triprift]

That was W1zz Nick all hail W1zz.

 

[wiak]

hooray!

Gods is back!

 

[dr emulator (madmax)]

Kursah: some chinese poopyheads have been doing a DoS attack on TPU for a while now. W1zz has tools in place to block it, but these outages occur when they try something new (unless this is something random, like the image server crashing)

i swear tg if it keeps happening i'm going to go over there and kick someones ass

 

[btarunr]

i swear tg if it keeps happening i'm going to go over there and kick someones ass

Kick your neighbour's first (for manhandling that pup) .

 

[dr emulator (madmax)]

Kick your neighbour's first (for manhandling that pup) .

what i can't kick a 4 year olds ass ,hey there's laws against that

:back on topic:

anyway as i said to someone they must have a purpose for doing such a thing ,other than ruining tpu i can't see the point of a dos attack most ch***** people don't even speak english so why the f*** it keeps happening is a mystery ,
i aught to make some contacts to find out

 

[human_error]

Did anyone else just have some connection resets and sluggish loading on TPU (took 2 mins to start to load homepage where it normally takes 2-4 seconds). Seemed to recover quickly and is fine now - i guess that could be TPU's new anti-DDOS code doing its job? Was definately TPU as i could load other websites quickly with no problems.

 

[W1zzard]

yes thats exactly whats happening right now. when it thinks the server is hung it restarts the server process so people can connect again

 

[FordGT90Concept]

That happens almost daily.

 

[Solaris17]

yes thats exactly whats happening right now. when it thinks the server is hung it restarts the server process so people can connect again

ya i noticed what he did and was like wtf? iv also been noticing it the past couple days aswell. W1zz is normal server usage triggering the reboots or are we still getting hammered by those attacks?

 

[W1zzard]

getting hit 24/7 now. its worse during china prime time but goes on over the whole day

 

[human_error]

when it thinks the server is hung it restarts the server process so people can connect again

Awesome, good to see TPU's getting more and more resistant to these attacks (hopefully the people behind them will move on soon enough - i hear twitter is the "hip new thing" to DDOS these days :shadedshu ).

**edit**

getting hit 24/7 now. its worse during china prime time but goes on over the whole day

Wow, didnt realise TPU was being hit 24/7, that's terrible (but good that TPU stays running without us realising this).

 

[Solaris17]

getting hit 24/7 now. its worse during china prime time but goes on over the whole day

jesus man you think other sites would have noticed as well. I wonder why we are the target...Good job on the psedo coding on the spot though i can deal with slowness every couple hours expecially if were getting hit 24/7 now if we didnt have the script the servers would be dead which mans no TPU time instead of SLOW TPU time.

 

[W1zzard]

i'm considering getting a second front end server for tpu logged in members only so the traffic is split. still not sure if it's worth spending ~200$ per month to offset a few minutes of downtime every day

so far we banned 3612 ip adresses (the bans last for 2 hours), some kept hitting the same url up to 900 times per minute

 

[Solaris17]

i'm considering getting a second front end server for tpu logged in members only so the traffic is split. still not sure if it's worth spending ~200$ per month to offset a few minutes of downtime every day

well it depends to guage its worth you would need to

A. See when the usuall downtime is
B. Is this downtime during the peak hours of the most visiting country and
C.Is news/reviews etc being posted more during these times.


if2/3 of these is a yes then id say its worth it.

 

[W1zzard]

at this time of day our traffic is at its lowest, during our peak times the attacks are no problem.
right now europeans are starting to come to tpu, and americans are sleeping tight dreaming of rv870. the hours before we only have asia/.au people which are not that many

right now we are at the right edge of that graph

 

[human_error]

i'm considering getting a second front end server for tpu logged in members only so the traffic is split. still not sure if it's worth spending ~200$ per month to offset a few minutes of downtime every day

so far we banned 3612 ip adresses (the bans last for 2 hours), some kept hitting the same url up to 900 times per minute

ouch, that's a lot of bannage right there.

I guess if you did put up a TPU members server you could get the non-member public server to ban all chinese IPs and just present them with a "you must register to be able to view TPU from your country" page instead. That is assuming that Chinese IPs are the primary origin of the DDOS attacks. Then again i don't know how much legitimate traffic it would ban from China and i guess the ddos would stop page requests and just go to other methods of DDOS attack.

 

[W1zzard]

i dont want to ban large ip ranges. and i've also seen some limited attacks from other non-asian countries

 

[Solaris17]

i dont want to ban large ip ranges. and i've also seen some limited attacks from other non-asian countries

ya but those could be extended bot nets outside of the host country...can you see if it can be broken down by area or are the attacks coming from all over china?

 

[human_error]

i dont want to ban large ip ranges. and i've also seen some limited attacks from other non-asian countries

Fair enough - are you able to have different pages load for different regions? (i'm thinking along the lines of have a Javascript page that loads for regions performing ddos attacks which requires the user to click a button before the tpu homepage will load (and place a cookie saying legit user which lasts for a few hours which is checked by the javascript for every tpu page load - this would be client side checking so wouldn't add too much overhead)). I'm not sure if that would help (you'd still get hammered on the page with the javascript, but it would be a lot less per machine than loading a page with proper tpu content).

 

[Flyordie]

I have had 3 DDOS's between Jan and May... all 3 from China... so I banned Chinese IPs and haven't had a SINGLE issue since May 19th.
I have a T3 Fiber line... *edit*

 

[W1zzard]

Fair enough - are you able to have different pages load for different regions? (i'm thinking along the lines of have a Javascript page that loads for regions performing ddos attacks which requires the user to click a button before the tpu homepage will load (and place a cookie saying legit user which lasts for a few hours which is checked by the javascript for every tpu page load - this would be client side checking so wouldn't add too much overhead)). I'm not sure if that would help (you'd still get hammered on the page with the javascript, but it would be a lot less per machine than loading a page with proper tpu content).

yes that is basically one fairly well documented web anti dos technique.. present a captcha to potential attackers. humans will solve it, scripts will fail

I have had 3 DDOS's between Jan and May... all 3 from China... so I banned Chinese IPs and haven't had a SINGLE issue since May 19th.
I have a T3 Fiber line... *edit*

we do have quite a bit of legit visitors from china. luckily this attack doesnt consume our bandwidth but just workers processes on the web server

 

[Solaris17]

yes that is basically one fairly well documented web anti dos technique.. present a captcha to potential attackers. humans will solve it, scripts will fail


we do have quite a bit of legit visitors from china. luckily this attack doesnt consume our bandwidth but just workers processes on the web server

i agree captcha the chinese IP's You could even go as far as to perma ban the IP's that cant solve the captcha this would eliminate load even on the captcha page.

 

[W1zzard]

but then there are a lot of visitors who dont understand what that captcha does and wont solve it

 

[Solaris17]

but then there are a lot of visitors who dont understand what that captcha does and wont solve it

this is true, but you could explain the situation perhaps the the top of the webpage and make it a simple captchya like a 3 letter. then enter button i know i hate the 18 letter/number ones but if you do 3 and tell them why it shouldnt be a problem. and to sway confusion you could put the TPU logo at the top so they know its associated and not a "server maintenence" thing