unix4

[Silverbug]

Tell them the attack is aimed at them by their competitors, and you are working on it - That should appeal to their egos

hmm thats not a bad idea, unless they are so thick that they demand you do something to stop it happening again so they dont loose business

[craigdunlop]

Is this the worst type of attack a network can get? It appears to be very easy for entire networks to be brought down for as long as the attacker persists; how do dedicated (no downtime) servers handle this sort of thing?

...bad ddos, grrrr....

[Brangwyn]

Many routers have floodguard style protection which usually helps with DDoS attacks, there are a few other types of floodguard style protection available as well (software based running on ingress points etc), most of it is generally quite reliable unless it's a really really big attack.

[craigdunlop]

What protection methods do Vortech have in place for this kind of thing?

[jetzkr8]

Still no sign the attack is letting up. Might as well consider why this is happening and what can we do in future to avoid such a 'unable to do anything' scenario; not to say the least Vortech techies are at it blocking etc. But really, what can anyone do.

Attacks are directed at one domain, right? The problem occurs as many domains share the same ip. Also why on this particular domain. This domain owner/content must really done something to get these guys into DDoD mode. Is it possible to isolate that domain requests by changing the IP resolution at the registrar level to point to a null ip that does not share other domains? Just my .02value here. After all we cannot do anything but wait.

[Brangwyn]

Is it possible to isolate that domain requests by changing the IP resolution at the registrar level to point to a null ip that does not share other domains? Just my .02value here. After all we cannot do anything but wait.

I think they've already tried that by changing the DNS entries for the domain within vortechs nameservers, problem is, that of course has to propagate so it could take 24 hours before it kicks in

[slips]

I wonder what http://www.block-ddos.com prices out at. Probably a pretty penny if it works as advertised.

[Frank]

The control panel and ftp uploads seem to be working better then they have in some time. I hope it stays this way. I've been complainig about waiting for the server on uploading in recent weeks. My guess is that we have been under attack for some time and it finally got bad enough that something had to be done. Keep blocking these unsecure, unupdated, unaware fools.

People with unsecure, unupdated computers that are getting taken over shouldn't be allowed to have broadband.

[jetzkr8]

Hiyall,
Seems like we are still under attack. I decided to go for a break and am chacking from a temporary location with dial-up so I may be wrong.

Just wondering if IP's are being blocked, is it possible this is something like SYN attack where routers are replying to spoofed ack probes which are ending up flooding Unix4. I read about this mode of attack from a link I think it was grc.com somewhere earlier in this thread. This being the case, blocking will certainly not do the trick. Again I am just speculating.

Been some time since admins updated us on what is hapenning?

[Frank]

There are times when pages come up slugishly. It appears Unix4 is not the box to be on. Any updates?

[Frank]

This is getting bad

[matthewshull]

I agree. Something has to be done. This has gone too long.

[Frank]

Would calling up crying speed things up!

[admin]

We are going to remove the IPFW rules to see if that helps, we have it blocking the 1,200+ IPs on the system still from the ddos the other day. That could be slowing things down a bit. They will be removed in just a few min.

The DDOS seems to be gone for the time being.

[Frank]

That doesn't appear to have fixed it