Unix1 8/24/2005 6:00am

[grayharley]

If someone or thing is determined to attack this server maby it needs to be unpluged from the network and renamed so the attackers cant find it.

I know this will mean some of us will have to update our FTP info and stuff but first time visitors dont normally come back to a site that was not found.

[byron]

Okay, here's a positive update for everyone. We've moved the server to a different location... (as in literally, physically... a new location) here at the office. The attacks have stopped in the process, and sites are available. Due to the fact that we have the box at office, transfer rates are not going to appear as fast as normal but sites are definitely accessible now. We are still working to develop a filtering solution for the attacks that have been affecting us thus far.

[TicoGrande]

All sites are still down Byron....

TG

[byron]

Now I'm being told that we have a routing issue to resolve since it has been moved to a different network segment. I'll keep you posted as details develop.

[hugo]

Any news on this, my sites are still down. Thanks.

[matthewshull]

My sites are trying to load. But VERY slowly and unusable.

[Two Roads Media]

Originally Posted by matthewshull

My sites are trying to load. But VERY slowly and unusable.

same here

[matthewshull]

Also, once it does load, none of the CGI seems to work. This particular site is built on CGI.

Any update? It has been 2 hours since the last one.

Thanks for your hard work.

[byron]

Okay, I have an update. We are going to change the SHARED IP of the box and null route it. We're also going to run IP Migration scripts which will require H-Sphere (The CP) to be taken offline as well. This is a very unfortunate situation, but we're going to have to take these steps to get everyone back online and knock this attack out of the picture. I'm going to start another thread advising when the Control Panel will be taken offline. Please continue to monitor this thread and the upcoming CP thread for the latest information as it becomes available. Thank you all for being so patient through this ordeal.

[TicoGrande]

I use an outside DNS service, so I will need to change the IP there. With that in mind, please post the new IP as soon as you can, and really important, WHEN the new IP will come online.

Not sure if there is a propagation thing for stuff like this, but I need to allow time for the changes.

Thanks

Hello guys, let's hang in there... I know this is a bad situation but I'm working with some new cisco equipament to stop this attack... It will take me about 1 and 1/2 hour to configure and put it in production... Hang in there..

[matthewshull]

Thanks Thiago. We know you are working hard there, sweating this out with the rest of us.

[hprio]

Any news guys ? We are almost 24 hours down already! I have at least 40 customer' sites plus 4 of mine including the hosting maint site on this server.

[Brangwyn]

Originally Posted by byron

Okay, I have an update. We are going to change the SHARED IP of the box and null route it. We're also going to run IP Migration scripts which will require H-Sphere (The CP) to be taken offline as well. This is a very unfortunate situation, but we're going to have to take these steps to get everyone back online and knock this attack out of the picture. I'm going to start another thread advising when the Control Panel will be taken offline. Please continue to monitor this thread and the upcoming CP thread for the latest information as it becomes available. Thank you all for being so patient through this ordeal.

I was going to suggest this about 8 hours ago .. the thing is though, it's only going to provide temporary relief, it won't stop the DDoS, it'll most likley just come back once DNS fully propagates ... or even worse yet, you change it, the DDoS actually stops, our customers still have upto 24 hours to wait before their sites actually work due to propagation.

Ring up someone at ThePlanet and find out what they use, their network is virtually bullet proof when it comes to DoS attacks, or perhaps at least get someone from CISCO around to try and help with the IOS rules.

[admin]

We found another way, this is our last stop or try to kick the DDOS in the butt. We are putting another 7206 just to drop the syn attack. I have not gotten an update from the tech doing the install but this should be faster then chaing everyones DNS. If this does not work soon we will be doing the IP change. Thats the last thing we wanted to do as it takes so long to take affect.