Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Possible DoS from my server?
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Possible DoS from my server?

KytroKytro Member
edited July 2015 in Help

The issue has been solved, thank you for everyone's help!

Comments

  • I had the same problem while downloading files using multiple connections on Crissic (aria2).

    I explained it to them, but there was no reply to the ticket. I was doing nothing else at that VPS and I never received another warning again, so that must have been the cause.

    Guess NodeWatch sees over X connections to the same destination in your container and considers it a DoS?

  • cociucociu Member

    I use nodewach in our nodes too but i want to tell you i am thinking to remove this shit because is not verry realistic. I thinck if you talk with your provider the issue can be resolved. Good luck

  • blackblack Member

    You want to contact your lawyer? Let's hope those torrents were legal then....

    Thanked by 1netomx
  • TheLonelyTheLonely Member
    edited July 2015

    @black said:
    You want to contact your lawyer? Let's hope those torrents were legal then....

    Just Linux ISOs

  • KytroKytro Member

    @black said:
    You want to contact your lawyer? Let's hope those torrents were legal then....

    Yes they're according to laws in my country and the country where the server is hosted.

    @TheLonely said:
    Just Linux ISOs

    A bunch of them!

    @Traffic said:
    I had the same problem while downloading files using multiple connections on Crissic (aria2).

    I explained it to them, but there was no reply to the ticket. I was doing nothing else at that VPS and I never received another warning again, so that must have been the cause.

    Guess NodeWatch sees over X connections to the same destination in your container and considers it a DoS?

    That's it, I was doing the same. But it's weird that NodeWatch says it's a "Possible DoS".

    @cociu said:
    I use nodewach in our nodes too but i want to tell you i am thinking to remove this shit because is not verry realistic. I thinck if you talk with your provider the issue can be resolved. Good luck

    Yeah, I kinda told them that.

  • Sounds like you've hit the set limit on NodeWatch PPS to trigger what looks to be a DoS attack when it isn't

  • If you want to download 30 torrents at once maybe you better go back to your DS at redstation.

    Thanked by 1netomx
  • KytroKytro Member

    @JoeMerit said:
    If you want to download 30 torrents at once maybe you better go back to your DS at redstation.

    I wish I could, but I've stopped using torrent, the issue is now HTTP/FTP connections.

  • what you are doing is probably more resource intensive than what the provider wants a customer to be doing in a shared environment at the price you are probably paying.

  • KytroKytro Member

    @JoeMerit said:
    what you are doing is probably more resource intensive than what the provider wants a customer to be doing in a shared environment at the price you are probably paying.

    It seems they never used NodeWatch or something similar, I'll see what they can do and what info. they can give me, appreciate everyone's help!

  • ClouviderClouvider Member, Patron Provider

    If they claim you were DoS'ing care to tell you the bandwidth, pps, type of attack ?

    Or they decided to just accuse you, and left you defending yourself against a few lines of log?

    Thanked by 1NexHost
  • KytroKytro Member

    @Clouvider said:
    If they claim you were DoS'ing care to tell you the bandwidth, pps, type of attack ?

    Or they decided to just accuse you, and left you defending yourself against a few lines of log?

    Basically I'm sitting on the corner with a few lines of code, but I've got my VPS back!
    I think the 'problem' here is that, they've never used NodeWatch (I guess they've added it to test) and they got scared just like I did.

  • ClouviderClouvider Member, Patron Provider

    Kytro said: I think the 'problem' here is that, they've never used NodeWatch

    So much for the professionalism of your provider...

  • next up.. terminated for IO abuse !

  • J1021J1021 Member

    Name the provider.

  • BruceBruce Member

    nodewatch says it's DoS, so it must be :)

    nodewatch is good, but needs to be checked. a good VPS will be able to saturate a Gb connection, which looks just like DoS. the nodewatch logs show you what is being sent/received. they just need to learn how to read them

    whitelist incoming conntrack, so the VM doesn't get suspended. then monitor the alert emails

  • SpiritSpirit Member

    What's with those people today...
    @Kytro don't open public forum thread if you're not prepared to keep it, please.

    Thanked by 3BensDaMan jvnadr Scion
This discussion has been closed.