Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


VPS Shut Down 150,000 UDP packets per second! - Page 2
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

VPS Shut Down 150,000 UDP packets per second!

24

Comments

  • blackblack Member

    @AnthonySmith said:
    Well perhaps someone wants to blackhole them any info is better than none.

    Yeah, I was going to write up a quick bash script to test how well my proxy detection code works, assuming they're somewhat legit IPs. If they're not, still a good laugh.

  • Mark_RMark_R Member

    @AnthonySmith said:
    Well perhaps someone wants to blackhole them any info is better than none.

    Yea, blackhole IP adresses of people who have no clue that their servers are attacking your shit, next week or month the attacker will scan for new exploitable servers and refreshes his IP list to make the attack strong again (removing all dead / discovered IP's.) it is a waste of time.

  • AnthonySmithAnthonySmith Member, Patron Provider

    @Mark_R said:

    Is that what they tech you in the school of roll over and take it?

    Thanked by 1fisle
  • Mark_RMark_R Member

    @AnthonySmith said:
    Is that what they tech you in the school of roll over and take it?

    My private life has nothing todo with this matter and is none of your concern. Anyways keep it up! way to go!

  • AnthonySmithAnthonySmith Member, Patron Provider

    hah ok np.

  • jarjar Patron Provider, Top Host, Veteran

    150k UDP?

    Unplug the switch. Works every time.

  • mikhomikho Member, Host Rep

    @Mark_R said:

    When the users of those IPs can't reach anything on the internet they might consider securing their server before production usage.

    Wouldn't be surprised if there are some Uni IPs among them. I talked to a tech not long ago who returned all pale from a Uni here in Sweden. The horror stories he shared.......

  • Mark_RMark_R Member
    edited July 2014

    @AnthonySmith said:
    hah ok np.

    What I tried to tell you is that blackholing will not help you, after you added all IP's to the list a few days later some new ones popup and take it all down once again. I understand that the position that you are in is not cool and hard to get out off. Blackholing is just a temporary solution and will not last long, you should consider to take a more extreme action, perhaps getting decent ddos protection or increasing the network ports (capacity.) I see no other way to deal with this problem without investing alot of money.. try keeping it up! whoever is behind attacking you right now is paying money to accomplish it aswel.

  • @Mark_R said:
    What I tried to tell you is that blackholing will not help you, after you added all IP's to the list a few days later some new ones popup and take it all down once again.

    Generally speaking, he's right. "Smart" attackers will cycle through IPs, it's an endless battle that inevitably serves little purpose. A lot of UDP is spoofed, so you could easily end up blocking people you don't want to -- some attackers will use this against you to cause further problems.

  • Mark_RMark_R Member
    edited July 2014

    @Microlinux said:
    Generally speaking, he's right. "Smart" attackers will cycle through IPs, it's an endless battle that inevitably serves little purpose. A lot of UDP is spoofed, so you could easily end up blocking people you don't want to.

    This is common sense for a long time now.. every decent HF booter uses this method. Everytime I see a provider talking about blackholing a DDoS attack I seriously start to lose faith in their services, it makes me wonder what year they live in. they probably still think that it are botnets who are attacking them while in fact it are Dedicated servers connected to strong networks that allow spoofing and use amp lists to send the packets through.

    Thanked by 1Cakey
  • netomxnetomx Moderator, Veteran

    So that;s why my VPS sent a lot of notifications of down VPS (my monitor is there)

  • netomxnetomx Moderator, Veteran

    @Mark_R said:

    And what do you suggest to do?

  • Mark_RMark_R Member

    @netomx said:
    And what do you suggest to do?

    Start reading the thread man jeez.

  • jarjar Patron Provider, Top Host, Veteran

    Mark_R said: This is common sense for a long time now.. every decent HF booter uses this method. Everytime I see a provider talking about blackholing a DDoS attack I seriously start to lose faith in their services, it makes me wonder what year they live in. they probably still think that it are botnets who are attacking them while in fact it are Dedicated servers connected to strong networks that allow spoofing and use amp lists to send the packets through.

    You have to deal with attacks short term too. Just because they will move on to a new source doesn't mean give up and accept the attack. Mitigation is an active state, not a passive one.

    Thanked by 1MartinD
  • mikhomikho Member, Host Rep

    Conspiracy theory: the ones who DDoS is actually the companies that sells protection. Similar to the theory that most viruses are created by the anti-virus companys. :)

    Thanked by 2support123 0xdragon
  • Mark_RMark_R Member
    edited July 2014

    @Jar said:
    You have to deal with attacks short term too. Just because they will move on to a new source doesn't mean give up and accept the attack. Mitigation is an active state, not a passive one.

    No! in my opinion every provider should start considering including DDoS protection in their entire infrastructure. the amount of attacks only increase every day and it is really easy for someone to get access to this malicious power, this only will grow and the providers have to grow with it or they will lose eventually..

    We should be looking for permanent solutions, not temporary.

  • netomxnetomx Moderator, Veteran

    @Mark_R said:
    Start reading the thread man jeez.

    • sighs * you're lost cause
  • Mark_RMark_R Member
    edited July 2014

    @netomx said:
    mexican

    Yea thanks alot for your input on this matter, much appreciated.

  • Mark_RMark_R Member

    *fixed most grammar mistakes.

  • netomxnetomx Moderator, Veteran

    @Mark_R said:
    *fixed most grammar mistakes.

    HAHAHAHAHA yeah I'm Mexican, live with it ;)

  • Mark_RMark_R Member

    @netomx said:
    HAHAHAHAHA yeah I'm Mexican, live with it ;)

    I had a good laugh too, that bugged quote plugin haha. @jbiloh

  • AnthonySmithAnthonySmith Member, Patron Provider

    @Mark_R not looking to start a fight but you clearly do not understand things from this side of the fence, not even a little bit. I accept that these IP's may all be spoofed I accept there may be a list of them in the millions, I just don't subscribe to curling up in a ball and taking it.

    I would rather try something than nothing or pay out £10,000+ for DDOS protection worth having and triple my prices.

    Thanked by 3jar eddynetweb 0xdragon
  • Mark_RMark_R Member

    @AnthonySmith said:
    Mark_R not looking to start a fight but you clearly do not understand things from this side of the fence, not even a little bit. I accept that these IP's may all be spoofed I accept there may be a list of them in the millions, I just don't subscribe to curling up in a ball and taking it.

    I would rather try something than nothing or pay out £10,000+ for DDOS protection worth having and triple my prices.

    Yeah, I have no clue okay, lets just stop it here. Goodluck @AnthonySmith .

  • AnthonySmithAnthonySmith Member, Patron Provider

    Agreed and thanks.

  • Mark_RMark_R Member

    @AnthonySmith said:
    Agreed and thanks.

    I forgot the /sarcasm tag, silly me.

  • jarjar Patron Provider, Top Host, Veteran
    edited July 2014

    Mark_R said: No! in my opinion every provider should start considering including DDoS protection in their entire infrastructure.

    Lol. Dare to dream brother, dare to dream. Every company should spend millions to fight what costs $15 to start. I'd rather we make it legal to go hunting for people that initiate a DDOS and shoot on sight. Open season, brothers.

  • AnthonySmithAnthonySmith Member, Patron Provider

    Ok so lets say you have walked a mile in my shoes, what is your operationally and financially considered solution?

  • Mark_RMark_R Member

    @Jar said:
    I'd rather we make it legal to go hunting for people that initiate a DDOS and shoot on sight. Open season, brothers.

    yea because that is totally working out right?

  • jarjar Patron Provider, Top Host, Veteran
    edited July 2014

    Mark_R said: yea because that is totally working out right?

    Are you just kind of a dick at all times or just when you want to be?

    I bet you're a blast at parties. Everyone sitting around chatting casually and suddenly you walk into a conversation and tell everyone they all make you lose faith in humanity if they don't do everything according to your unrealistic expectations, then just keep repeating it until no one wants to be there anymore. No offense, just dial it down a bit, you're a buzz kill.

    Thanked by 1netomx
  • OVH spoiled everyone.

    Thanked by 3jar Pwner zionvps
Sign In or Register to comment.