+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: DDOS and Slowdown (/showthread.php?tid=494462)
* - cobija - Jun 21, 2010
(Jun 21, 2010 09:34 AM)Omniscient Wrote: I fight DDOS attacks myself. This one is being handled by the server just fine. It's about 400-500k packets per second. Anyone will less experience would be down right now.
At least we dont have those french annoying hackers like last month or a few months ago that HF wouldnt even load.
* - Ŀucien Lachance - Jun 21, 2010
It is not that bad, imo. We've had worse.
* - gahccbb - Jun 21, 2010
Lmfao, just got my new internet.
It takes like 3 seconds to load, nice work Omni.
Just filter the IP's ?
* - Factor8™ - Jun 21, 2010
Their failure is your success always :)
Great job.
* - CyberPhunk - Jun 21, 2010
Great !! :)
also does the cloud hosting helps share the ddos load?
* - Omniscient - Jun 21, 2010
It's not a matter of filtering the IP's. The traffic will still hit the server at the firewall level. The slowdown we do have is simply the firewall reviewing each packet an figuring out who is legit. As you can see from screenshot the server is not overloaded at all. Load is at a very normal 1.6 right now.
The packets are empty anyways and aren't doing anything but hitting port 80. They appear to be incomplete fragments probably with malformed headers.
* - Far - Jun 21, 2010
(Jun 21, 2010 09:08 AM)Omniscient Wrote: Right now we have a 80mbps attack on the server. So it takes a while for the site to load. But as you can see we're still in business. :)
80mbps? How much of that is filtered?
(Jun 21, 2010 09:54 AM)Omniscient Wrote: It's not a matter of filtering the IP's. The traffic will still hit the server at the firewall level. The slowdown we do have is simply the firewall reviewing each packet an figuring out who is legit. As you can see from screenshot the server is not overloaded at all. Load is at a very normal 1.6 right now.
The packets are empty anyways and aren't doing anything but hitting port 80. They appear to be incomplete fragments probably with malformed headers.
Ah, I see now. Good thing we got a DDoS expert 😉
* - Omniscient - Jun 21, 2010
Quote:80mbps? How much of that is filtered?
Let's put it this way...out of about a million packets only 15 are kept. That's how much the firewall is blocking.
* - fantomx - Jun 21, 2010
[deleted]
* - Far - Jun 21, 2010
(Jun 21, 2010 09:58 AM)Omniscient Wrote: Let's put it this way...out of about a million packets only 15 are kept. That's how much the firewall is blocking.
Wow. Something is telling me you're using Online Armor firewall 😝
* - xTiNgUiSh - Jun 21, 2010
(Jun 21, 2010 09:54 AM)Omniscient Wrote: It's not a matter of filtering the IP's. The traffic will still hit the server at the firewall level. The slowdown we do have is simply the firewall reviewing each packet an figuring out who is legit. As you can see from screenshot the server is not overloaded at all. Load is at a very normal 1.6 right now.
The packets are empty anyways and aren't doing anything but hitting port 80. They appear to be incomplete fragments probably with malformed headers.
I find it very interesting. You should make a tut. on how to do this in the website section. I think many people will appreciate this including myself.
* - iPhone - Jun 21, 2010
Thanks for the info Omni.
* - Omniscient - Jun 21, 2010
I just made some new adjustments so that firewall is dropping the empty packets even faster. I can already see more people are online now. A few tweeks here and there and my firewall will be solid.
Thanks DDOS'ers for the experience. I needed to do some new testing of my rulesets anyways.
* - SNap! - Jun 21, 2010
Probably some skids over at Stond.org.
* - Condoms - Jun 21, 2010
What i dont understand is why people make tons of topics that are already posted in announcements..
and that no one reads the twitter about why HF was down.