said by justin :

But a modern ddos attack is much more subtle and involves so many machines that data centers are not (as I understand it) often able to do much more for you.

said by justin :

But a modern ddos attack is much more subtle and involves so many machines that data centers are not (as I understand it) often able to do much more for you.

That is why services like ProxyShield cost $1000/month on up and sell to people located in any data center. Go google it up and read what they offer, then wonder if your own webhost would offer the same thing for free? (or nac.net for that matter).

said by SND2005 :

If you are paying nac.net to provide connectivity, ...

said by Matt :

Please keep in mind the most of these computers are likely not willing participants in this attack and probably don't even know they have been rooted. They are zombie computers being controlled by someone nefarious, so don't log into their device and use the information for any reason. Especially don't post it in a public forum.

Log into their devices and change their gateway sure ... to stop that device from attacking, but posting or using personal information makes you no better than the zombie controller.

said by TKJunkMail :

Vista is more secure than Windows/XP and as secure as a Mac system. Where did you come up with the idea that Vista is less secure?

said by rawgerz :

So I guess that DSLR won't ever be pingable again?

said by robertfl :

this will probably get worse when people "upgrade" to vista and their lack of security.

said by 81399672 :

A lot of them are in Russia. Good luck ever getting them shut down.

said by Nsane_iceman :

As a side note...

If you have a Linksys PAP2 use a password for it. It has your name(Mr. Jazayeri), location (CA, USA), call(s) (12136129xxx) made on the webadmin page.

said by Nemokrad :

Any luck with that?

said by Nsane_iceman :

If you will PM me the IPs. I will see if I can get the .exe or config to find where they are gathering and shut em down.

said by ureihcim :

It looks like you got things now under control since I talked to you at 2AM.

I will now take the temp forum offline, and good luck.

said by djr777 :

I did it.
But the pub is for registered members only. It can't be accessed unless you are a member so if the member was the culprit he already had this info as well.

said by Shrapnel64 :

If you do a google search for the main address, you will pretty much see a boatload of posts which have the alternates (unfortunately).

But, I agree -- the Site Announcement, which clearly said it was for registered users should not have been posted. Thanks for being an outstanding mod and staying on top of everything!

said by justin :

no need for secrecy.

the current blacklist is
»/front/blackli···rted.txt

all were collected in the last 2 hours.

said by RickNY :

Can someone PM me the alternate URL or IP to access the site?

Thanks,
Rick

said by RickNY :

Can someone PM me the alternate URL or IP to access the site?

said by justin :

no need for secrecy.

the current blacklist is
»/front/blackli···rted.txt

all were collected in the last 2 hours.

said by djr777 :

Is there anything the average user like myself can do to help? If there is let me know.

said by jabarnut :

Just a reminder...I've seen many registered users posting the alternate addresses for BBR.

One person even posted the entire site announcement from yesterday, intended for registered members only. :uhh:
They have since been edited out, but a little common sense may go a long way.

said by jabarnut :

Just a reminder...I've seen many registered users posting the alternate addresses for BBR.

One person even posted the entire site announcement from yesterday, intended for registered members only. :uhh:
They have since been edited out, but a little common sense may go a long way.

said by signmeuptoo :

Good points well taken, I didn't mean to bash any place really, more that it seems so much trouble appears to originate in those places (why?)

My sympathy to Justin (and team) too, he and his team run a fine site, a place that is like home to me and so many!

said by Doctor Olds :

Yes, I'd agree and I do stand behind BBR.

I just hope they can pinpoint some of the control bots and get a watcher planted to enable trackdown of the master bot control. These criminal bastards need to be removed from the Net and all ISPs need to clean their blocks of infected PCs or shut their access off until they are clean. It has to stop.

said by Rick :

I'd have to imagine that everyone would join me in saying with ONE opinion..that we stand behind you 100%.

said by Alcohol :

I guess the script kiddie was a registered user because i couldn't get on the site with the alternative urls either

said by justin :

so.. the simpler and more immediate solution is round robin dns and more ports..

said by justin :

The problem is how many packets per second interface cards (and the driver, and the kernel, and ones netfilter config) can handle without dropping packets on the floor.

said by justin :

it isn't the number of web servers in this particular case: we can recognize and ignore bad requests before they take any page creation time. The problem is how many packets per second interface cards (and the driver, and the kernel, and ones netfilter config) can handle without dropping packets on the floor.

most servers have adapters not THAT much more powerful in packet handling terms than the ones that come with PCs. So you can see that if a PC has a clear shot at sending as many packets as possible (size is immaterial) to a server then the only defense is sufficient interface muscle on the other end to deal with them all without throwing away half that arrive due to simple lack of buffers/time.

said by justin :

yes they can (and have) put in filters.

But in this case the hardest part to defeat is an ever-changing roster of IPs, with about 6000 active at once and all attempting to open and hold many connections at once so even if you are under your bandwidth (as we are) you might be over your capacity to properly filter and process that many packets per second.

There is no facility for either them to manage this type of active block list, or to identify in real time (as I can do this end) which IPs make it to the list, and which can fall off.

Believe me if there was a very simple solution I'd do it within hours.

said by robertfl :

Justin, does your hosting provider offer this sort of protection from attacks?

-Rob

said by MysticGogeta :

I would figure it would just amount to banning the IP of the individual. I have a feeling the ass came from one of the forums and decided to "Show Us" I really hope you report this to his/hers ISP and they get in trouble for this. Then again its likely they are smart and use proxy's.

said by justin :

I have no idea what the target or aim is, and yes the botnet is still nearly all east europe broadband pcs although your guess is as good as mine as to who the paymaster is.

said by TKJunkMail :

BBR still periodically slow as molasses - especially the i.dslr.net image server.

I assume the DDOS is still going strong.

said by signmeuptoo :

People that attack useful, good, important sites like DSLR are losers and fools. They prove nothing, they aren't proving that they are smarter, because they aren't, smart is showing respect for others. They aren't superior, they are just kiddies with kiddie brains.

said by fartness :

I don't understand how the UDP attack works... does there have to be something running on UDP for it to take the site down? Or are there just too many random packets being generated that it slows things down?

said by fartness :

I don't understand how the UDP attack works... does there have to be something running on UDP for it to take the site down? Or are there just too many random packets being generated that it slows things down?

said by kywirelessgu :

Someone hire Chris Hansen to do some investigating. Bait them with an unfirewalled packard bell running windows 98 and aol.

said by justin :

...but also a pile of pointless udp traffic got added after that didn't work, to try to fill up the port - which it did for a few hours.

said by sailor :

I had to google DDOS denial of service attack as I had no clue what that even was. So after reading about it I have a question for you. When this happens to your site here, do you ever get contacted by those behind it for anything?...Like attempting to extort money from you or anything at all?
Thanks.

said by justin :

Same as a couple of weeks ago, sorry!

said by Turbocpe :

I see a lot of posts here referencing a "backup IP". I've been here for several years, and I'm not certain what this backup IP is? Can someone point me to it for future reference?

said by justin :

About 2000 ips mainly eastern europe doing a stream of open and open-holds, but also a pile of pointless udp traffic got added after that didn't work, to try to fill up the port - which it did for a few hours. You can see the traffic graph flatlines at the top so the rest wasn't even reaching us, but getting dropped in nac somewhere.

said by justin :

try the main site again.. it looks to be almost ok now.

said by Matt :

What type of ddos attack are they using? Just standard HTTP requests to overload the Apache servers? SYN attack?

I noticed earlier this morning that ping times to the server were still great, so I assumed it was an HTTP attack of some sort?

said by jabarnut :

You know many of us go into panic mode, and have immediate withdrawal symptoms when the site is down.

said by justin :

try the main site again.. it looks to be almost ok now.

said by jabarnut :

And the good times just keep on coming.
Bummer for sure. :(
Good luck justin.

You know many of us go into panic mode, and have immediate withdrawal symptoms when the site is down.

Whew! At least I'm here for the moment.....I'm starting to feel a little better. :)

said by haha :

Their are many different sites around, might want to wonder around while this site is down :)

said by jabarnut :

.....I'm starting to feel a little better. :)

said by jabarnut :

And the good times just keep on coming.
Bummer for sure. :(
Good luck justin.

You know many of us go into panic mode, and have immediate withdrawal symptoms when the site is down.

Whew! At least I'm here for the moment.....I'm starting to feel a little better. :)

said by TKJunkMail :

ISPs should boot all their customers who have had their devices controlled by a botnet until those PCs are cleaned. It would cause the ISPs to take a short term hit on income, but in the longer term it would be better for everyone.

said by CCat :

...Not your fault though.