|
You last visited: Today at 17:33
Advertisement
[Discussion/Theory]About the recent DDOS attacks
Discussion on [Discussion/Theory]About the recent DDOS attacks within the SRO Private Server forum part of the Silkroad Online category.
07/06/2012, 15:31
|
#46
|
elite*gold: 0 
Join Date: Mar 2009
Posts: 2,748
Received Thanks: 2,010
|
Quote:
Originally Posted by PortalDark
i have never done this so im gonna ask
is there a way to notify the hosting company to report all this DDOS activities?
|
yes, if you look it up in the appropriate NIC database (eg. ripe for eu, arin for us), you can get the abuse email for the instance who is in charge of the ip. Just send an abuse report to that email with all the needed details (time, ip, type of attack, etc)
|
|
|
|
07/06/2012, 15:37
|
#47
|
elite*gold: 0
Join Date: Jul 2009
Posts: 1,121
Received Thanks: 420
|
Quote:
Originally Posted by r7slayer
Yea the DDoS company do commit a crime to gain money sure... And have you seen them advertising thier protection directly to these servers? I havnt so bit pointless and a waste of money for them to do such a crime. Not worth it at end of the day. So not so simple well might seem that way for your simple mind cos you cant think things through and the same for everyone else that comes to such a conclusion...
|
Think about it ...
The most Privateservers are illegal 
So why should they run to the police for example?! It's easy to ddos them...
|
|
|
|
|
07/06/2012, 15:56
|
#48
|
elite*gold: 505
Join Date: Nov 2008
Posts: 600
Received Thanks: 522
|
Quote:
Originally Posted by Nezekan
there are some really weird ips in there, what kind of attack are they doing on your server?
|
By the way, if only those IPs are attacking, is it possible to solve that by blocking these IPs in Windows Firewall?
16:33:19 An incoming packet(Allowed) Protocol: UDP, Source port: 138, Destination port: 138
.... EDEEEFFGDCCACACACACACACACACACACA. FHEPFCELEHFCEPFFFACACACACACACABN.SMB%............ .................&.................&.V...... 7.\MAILSLOT\BROWSE..
.CDEV2.............Ucdev2.
|
|
|
|
|
07/06/2012, 16:56
|
#49
|
elite*gold: 0
Join Date: Mar 2009
Posts: 2,748
Received Thanks: 2,010
|
Quote:
Originally Posted by pH33n1x<3
By the way, if only those IPs are attacking, is it possible to solve that by blocking these IPs in Windows Firewall?
16:33:19 An incoming packet(Allowed) Protocol: UDP, Source port: 138, Destination port: 138
.... EDEEEFFGDCCACACACACACACACACACACA. FHEPFCELEHFCEPFFFACACACACACACABN.SMB%............ .................&.................&.V...... 7.\MAILSLOT\BROWSE..
.CDEV2.............Ucdev2.
|
for really small attacks that can help, but for bigger attacks it's rather useless
|
|
|
|
|
07/06/2012, 17:04
|
#50
|
Chat Killer In Duty
elite*gold: 5
Join Date: May 2008
Posts: 16,390
Received Thanks: 6,508
|
shame SRO cannot implement ipv6 since it would help for now
|
|
|
|
|
07/06/2012, 17:33
|
#51
|
elite*gold: 505
Join Date: Nov 2008
Posts: 600
Received Thanks: 522
|
Attack methods:
-amplified udp reflection
-ssyn
Attack size: 1gbps average / 300k pps
Attack duration: it seems that the attacks last only 10 minute or less.
The attacks come from all around the world (could be spoofed?).
|
|
|
|
|
07/06/2012, 17:35
|
#52
|
elite*gold: 4
Join Date: Jun 2012
Posts: 322
Received Thanks: 259
|
Quote:
Originally Posted by pH33n1x<3
Attack methods:
-amplified udp reflection
-ssyn
Attack size: 1gbps average / 300k pps
Attack duration: it seems that the attacks last only 10 minute or less.
The attacks come from all around the world (could be spoofed?).
|
now I am sure 100% that joymax is doing this
|
|
|
|
|
07/06/2012, 17:50
|
#53
|
elite*gold: 505
Join Date: Nov 2008
Posts: 600
Received Thanks: 522
|
Quote:
Originally Posted by ♯ᵜBraveSlaveᵜ♯
now I am sure 100% that joymax is doing this
|
What makes you so sure? =)
|
|
|
|
|
07/06/2012, 17:50
|
#54
|
elite*gold: 4
Join Date: Jun 2012
Posts: 322
Received Thanks: 259
|
I've known who sends attacks on large private servers he is from my friends on the internet and this picture of send attacks to overlimit
|
|
|
|
|
07/06/2012, 17:53
|
#55
|
elite*gold: 0
Join Date: Jun 2012
Posts: 29
Received Thanks: 25
|
roflmao np i open hoic and take screenshot with vatican.va > im anonymous . nice one
|
|
|
|
|
07/06/2012, 17:57
|
#56
|
elite*gold: 0
Join Date: Mar 2009
Posts: 2,748
Received Thanks: 2,010
|
Quote:
Originally Posted by ♯ᵜBraveSlaveᵜ♯
I've known who sends attacks on large private servers he is from my friends on the internet and this picture of send attacks to overlimit
|
that's not a ddos attack, that's a lame kid doing a 'DoS' attack with a retarded script kiddy program
Quote:
Originally Posted by PortalDark
shame SRO cannot implement ipv6 since it would help for now
|
IPv6 would not help against DDoS attacks at all, there has been no real structural security improvement to take care of denial of service attacks in the new protocol.
Quote:
Originally Posted by pH33n1x<3
Attack methods:
-amplified udp reflection
-ssyn
Attack size: 1gbps average / 300k pps
Attack duration: it seems that the attacks last only 10 minute or less.
The attacks come from all around the world (could be spoofed?).
|
UDP is really easy to mitigate, just request your upstream provider to block udp to your server, silkroad does not need it. syn attacks are a bit harder to mitigate, since they are stealthed as actual legit traffic. It could help to limit syn requests, but your firewall would probably explode with 300kpps.
It might be a small botnet, or even a booter, and yes the udp attack might be spoofed.
|
|
|
|
|
07/06/2012, 18:01
|
#57
|
elite*gold: 4
Join Date: Jun 2012
Posts: 322
Received Thanks: 259
|
Quote:
Originally Posted by ♫>,<♫
roflmao np i open hoic and take screenshot with vatican.va > im anonymous . nice one
|
He is owner of private server and it does this in order to close all private servers to his server becomes top one in the region
and he Has sent me this picture, so I liked that show you the picture no more.
|
|
|
|
|
07/06/2012, 18:04
|
#58
|
elite*gold: 0
Join Date: Mar 2009
Posts: 2,748
Received Thanks: 2,010
|
Quote:
Originally Posted by ♯ᵜBraveSlaveᵜ♯
He is owner of private server and it does this in order to close all private servers to his server becomes top one in the region
and he Has sent me this picture, so I liked that show you the picture no more.
|
A DoS attack using LOIC, even with a 10gbit connection would be totally useless. Even a chicken could mitigate that, besides he's using http so he's only targetting the webpage, which is even dumber. I hope he knows that the malicious packets contain his ip, so he's just a call away from loosing his own server ^^
|
|
|
|
|
07/06/2012, 18:34
|
#59
|
elite*gold: 505
Join Date: Nov 2008
Posts: 600
Received Thanks: 522
|
198.195.196.112 - MCI/SAE
201.99.147.102 - Uninet S.A. de C.V.
8.127.147.100 - Level 3 communications
16.77.188.70 - Hewlett Packard
122.94.188.74 - China TieTong Telecommunications Corporation
122.104.147.101 - Optus (phone service provider)
210.82.148.101 - China Unicom IP network
63.21.11.102 - UUNET Technologies
24.80.148.102 - Shaw Communications
183.129.67.66 - CHINANET Zhejiang province network
93.217.89.11 - Deutsche Telekom AG
62.191.26.120 - Verizon Nederland B.V.
178.66.188.74 - OJSC North-West Telecom
78.96.147.106 - UPC Romania SRL
82.97.147.100 - TNG AG
80.99.147.105 - UPC Magyarorszag Kft. (Hungarian provider, lol I will contact them)
36.43.174.118 - CHINANET SHAANXI PROVINCE NETWORK
|
|
|
|
|
07/06/2012, 18:50
|
#60
|
elite*gold: 0
Join Date: Mar 2009
Posts: 2,748
Received Thanks: 2,010
|
Quote:
Originally Posted by pH33n1x<3
198.195.196.112 - MCI/SAE
201.99.147.102 - Uninet S.A. de C.V.
8.127.147.100 - Level 3 communications
16.77.188.70 - Hewlett Packard
122.94.188.74 - China TieTong Telecommunications Corporation
122.104.147.101 - Optus (phone service provider)
210.82.148.101 - China Unicom IP network
63.21.11.102 - UUNET Technologies
24.80.148.102 - Shaw Communications
183.129.67.66 - CHINANET Zhejiang province network
93.217.89.11 - Deutsche Telekom AG
62.191.26.120 - Verizon Nederland B.V.
178.66.188.74 - OJSC North-West Telecom
78.96.147.106 - UPC Romania SRL
82.97.147.100 - TNG AG
80.99.147.105 - UPC Magyarorszag Kft. (Hungarian provider, lol I will contact them)
36.43.174.118 - CHINANET SHAANXI PROVINCE NETWORK
|
some of them are directly from ip providers, not from normal ISPs, also some are from company networks. That's a very weird mix...
|
|
|
|
 |
|
Similar Threads
|
[Guide] Protect Your Server From * ,..., * Attacks (attackers) DDoS vdos etc
06/06/2014 - SRO PServer Guides & Releases - 71 Replies
Sorry guys for not answer some people cuz i'm verry busy these days and i will check all masseges as soon as i can .
Most of People asking me for ddos attack problem and most of us are in some problems from this cuz it's make the server down and u will lose players and so .. So
Today i will explain how to protect ur server from some kinds of attack like ddos and ..etc (No more kids will doss ur server to get more players to his server :P)
with windows server 2008 or (windows 8~but not...
|
[HELP!]DDos attacks on closed port?!
01/21/2012 - Metin2 Private Server - 0 Replies
Hello, I am writing this message for a problem.
There are 3 days that my server is under ddos attack, hundreds of different ip, always on the same port: 25345, but the problem is that the port is closed!, turned antispoof rules,sent packets from 2k and response packets 500k.
I use ipfw as a firewall ..
Those are the rules that I've put in my IPFW :
$IPF 12 deny all from any to any dst-port 25345 in keep-state
$IPF 13 deny all from any to any dst-port 25345 out keep-state
$IPF 14...
|
ddos attacks on aionbot sites
10/22/2009 - Aion - 3 Replies
Seriously this is ridiculous whats going on..
example: nofap bot released new version of his bot which cost money now -> 1day later nofap.com getting ddos crazy..
whats your opinion to this ?
|
All times are GMT +1. The time now is 17:33.
|
|
![[Discussion/Theory]About the recent DDOS attacks](https://www.elitepvpers.com/forum/iconimages/sro-private-server/discussion-theory-about-recent-ddos-attacks_ltr.gif){kind=small}
