dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
11195
share rss forum feed


AB
Premium
join:2006-04-04
Leesburg, VA
kudos:3

6 recommendations

reply to La Luna

Re: Todays DDOS (site down)

said by La Luna:

. . Mele can't get here either . . . .
There's an old saying that every cloud has a silver lining . . .

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5

1 edit
reply to La Luna

Hi again La Luna....fancy meeting you here!

I see you got invited also to do the proxy test. I'm so grateful because I have not been able to get to this site via the regular address or the IP given to members since the attack started at 10PM HST March 18 when I suddenly could not post my forum remark. I use Ping Plotter's TCP engine so dslr should be responding to those pings but Ping Plotter is showing 73% packet loss at dslr hop and both dslr and nac.net show "error" on the last two hops since last night. The alternative IP, around 2AM HST, let me login and then immediately flipped me back to the front page announcement. About an hour ago, that IP was seen by the Proxomitron to be unaccessible. So, I am so happy to be able to get here on this proxy.

This is a really rotten thing to do to dslr. I reported the Road Runner IP addresses on the list to RR abuse but that was just a drop in the bucket. Thanks Justin and nil for all the hard work and keeping the site up as much as possible.

EDIT: right after posting this I saw La Luna's post saying she could now get here normally. I checked Ping Plotter and it was showing normal pings to dslr for the first time since last night. So, I tried to get here normally and was able to do so!
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason



rob_in_chatt
Premium
join:2004-09-17
Chattanooga, TN
reply to justin

punk bastards on spring break with nothing better to do i guess.



PolarBear03
The bear formerly known as aaron8301
Premium
join:2005-01-03
reply to dliw

said by dliw:

said by kkb:

Welcome back Justin! Thank you for your effort and the great site.
Hear~Hear!
I second -er, third that!


David
I start new work on
Premium,VIP
join:2002-05-30
Granite City, IL
kudos:101

justin

Do you need anything for me to turn over to security on our end (at&t that is)?

Let me know, or if you want post the IP's in the direct forum.

Thanks
david



justin
..needs sleep
Australian
join:1999-05-28
kudos:15
Reviews:
·iiNet

1 recommendation

thanks, but don't worry about it. I actually didn't expect individual IPs to be shut off (although I should have thought about it harder, the list wasn't 100% clean) my intent was for someone to id and possible kick over the command/control machine which normally requires snooping the traffic to a zombie to see where it is getting instructions from.

taking out individual hosts is kind of a losing proposition - labor intensive, and the hosts are easily replaced by others. The vast majority of these IPs were overseas anyway.

they've fallen silent now anyway so as far as the site goes it is over with..



David
I start new work on
Premium,VIP
join:2002-05-30
Granite City, IL
kudos:101

Ok, yea I guess that would be kind of labor intensive nailing them one at a time.

I guess next time I can have your people talk with mine?



La Luna
RIP Lisa
Premium
join:2001-07-12
Warwick, NY
kudos:3
reply to Mele20

Re: Todays DDOS (site down)

said by Mele20:

Hi again La Luna....fancy meeting you here!

I see you got invited also to do the proxy test. I'm so grateful because I have not been able to get to this site via the regular address or the IP given to members since the attack started at 10PM HST March 18 when I suddenly could not post my forum remark. I use Ping Plotter's TCP engine so dslr should be responding to those pings but Ping Plotter is showing 73% packet loss at dslr hop and both dslr and nac.net show "error" on the last two hops since last night. The alternative IP, around 2AM HST, let me login and then immediately flipped me back to the front page announcement. About an hour ago, that IP was seen by the Proxomitron to be unaccessible. So, I am so happy to be able to get here on this proxy.

This is a really rotten thing to do to dslr. I reported the Road Runner IP addresses on the list to RR abuse but that was just a drop in the bucket. Thanks Justin and nil for all the hard work and keeping the site up as much as possible.

EDIT: right after posting this I saw La Luna's post saying she could now get here normally. I checked Ping Plotter and it was showing normal pings to dslr for the first time since last night. So, I tried to get here normally and was able to do so!
Hi Mele!!! LOL!!!

Yeah, that little proxy app worked very nicely.
--
10,754 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7

1 recommendation

reply to Mele20

Click for full size
said by Mele20:

So, I tried to get here normally and was able to do so!
Same here.. but I am never normal after driving that jersey turnpike to get to the server.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/


dvd536
as Mr. Pink as they come
Premium
join:2001-04-27
Phoenix, AZ
kudos:4
reply to exocet_cm

said by exocet_cm:

For the folks that can't get here, an IRC room available?
theres the unofficial room on removed's server

irc.removed.us

#dslr
--
You can never be too rich, too thin or have too much Bandwidth


panda
Visualize Whirled Peas

join:2000-01-08
Largo, FL
reply to doppler

said by doppler:

I always thought you can turn the tables on these guys.

A couple of times I ran a small limited FTP for a few forum
friends. To pass about a couple of large files. I only
limited to 2 open connections and not anon. Of course some
jerks, would not follow the 2 rules.

Since this was a while back. And they all were running
windoze boxes. Simple ping-of-death was possible, to knock
off the offender.

I know, you will not get the botmaster. But maybe a few
slaves would wonder why they froze and fix there damn systems.

Maybe I am being to simplistic and assuming some intelligence
of the end-parties.
The fact that their IP is pwned is proof of their limited or non-existent intelligence.

And, your "forum friends" with the learning disability are further proof of limited intelligence.

I too tried running an ftp server, but nobody followed "the rules". I guess my friends are even dumber than yours.

I like the idea of ddos-ing the botnets, though. I wish there was an automatic way to do that...


--
"[He] couldn't get a clue if he stripped naked, rubbed himself with clue musk, went to the middle of the clue breeding grounds at the height of clue breeding season when it was full of horny clues and did the clue mating dance for days."

djlandkpl

join:2007-12-27
Norton, MA
reply to justin

I can't get in via Comcast. I'm currently accessing thru a proxy.



Smith6612
Premium,MVM
join:2008-02-01
North Tonawanda, NY
kudos:24
reply to justin

I saw the message a few days ago the morning it happened. I was not home then, but I wasn't able to log in, but the site was responding nicely.



sansri88
digital is here
Premium
join:2005-12-17
New York, NY
kudos:1
reply to justin

Justin! What happened now?



nil
Java Geek
join:2000-11-27
kudos:2

This was unrelated, just some gremlins needed flushing out.



sansri88
digital is here
Premium
join:2005-12-17
New York, NY
kudos:1

Phew good. I thought we were under attack again.



Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7

3 edits
reply to sansri88

Appears to be happening again

This works very well

ht tp://209.123.109.175/forum/security

but not this many times during the day..

ht tp://www.dslreports.com/forum/security

edit..thanks nil
--
Gladiator Security Forum »www.gladiator-antivirus.com/
Missing Kids
»www.missingkids.com/



Jafo232
You Can't Spell Democrat Without Rat.
Premium
join:2002-10-17
Boonville, NY

Finally able to get back on now.. Still a bit intermittent but much better..

Probably unlikely, but I hope that we someday find out who this individual(s) is.
--
Custom PHP/Perl Development. Vbulletin And Wordpress Mods Too!



David
I start new work on
Premium,VIP
join:2002-05-30
Granite City, IL
kudos:101

To Karl

Are you doing a news article today entitled

"From Russia, with love" and putting a Bond pic up as a photo?

We will have evil characters like boris and natasha.



Gone Fishing
Premium
join:2001-06-29

1 edit
reply to justin

Re: Todays DDOS (site down)

NM



La Luna
RIP Lisa
Premium
join:2001-07-12
Warwick, NY
kudos:3

1 edit

»main url not working, anyone else?



rawgerz
The hell was that?
Premium
join:2004-10-03
Grove City, PA
reply to justin

I think it's about time one of these was plugged in.

»www.cisco.com/en/US/products/hw/···/ps2030/



justin
..needs sleep
Australian
join:1999-05-28
kudos:15
Reviews:
·iiNet

the ddos appliances don't work very well if the attack fills up your port, then you must rely on upstream filters which usually involves delays while they are obtained.

we don't have much difficulty with evading the ddos (it is ongoing now, not being ignored) it is removing the traffic that is meant to overwhelm the port that is the pain.



La Luna
RIP Lisa
Premium
join:2001-07-12
Warwick, NY
kudos:3

1 edit
reply to justin

The alternate link is really slow now too.

Seems to be hanging on i.dslr.net

and google-analytics.com



Anonymous_
Anonymous
Premium
join:2004-06-21
127.0.0.1
kudos:2
Reviews:
·Time Warner Cable

2 recommendations


the internet
back up ip is very slow for me now

main does not load at all

download is very slow but the up is fine


Bada Bing
WVU Mountaineers
Premium
join:2001-05-29
Fort Gay, WV
reply to justin

»www2.dslreports.com
has no load as of now and it's loading very fast for me.
--
Rock & Roll Never Forgets



sansri88
digital is here
Premium
join:2005-12-17
New York, NY
kudos:1
reply to justin

Wow the regular site was completely down, and the secondary was super slow until 5 minutes ago.



acadiel
Press fire to begin
Premium
join:2002-06-22
61705
kudos:2
reply to Anonymous_

said by Anonymous_:

back up ip is very slow for me now

main does not load at all

download is very slow but the up is fine
LOL - I saw that episode last night - it was a hoot!!!
--
acadiel's blog is here


rawgerz
The hell was that?
Premium
join:2004-10-03
Grove City, PA
reply to justin

Well I'm sure you know more about it than me, but I wouldn't put them off completely.

As a temporary solution, can you deny traffic outside the USA and Canada? Don't know if servers can identify source.
Or even just disable ICMP?
--

You can't make all the people happy all of the time. But it should be common sense to shoot for the majority.



pcdebb
RIP lil hurricane
Premium
join:2000-12-03
Brandon, FL
kudos:5
Reviews:
·Bright House

said by rawgerz:

As a temporary solution, can you deny traffic outside the USA and Canada? Don't know if servers can identify source.
Or even just disable ICMP?
i would think that would not be a viable solution considering we have alot of regular users outside of usa and canada.
--
a time for change... | 1st & 10 | Ham is good