[Discussion/Theory]About the recent DDOS attacks

[Biboja]

93.217.89.11 - Deutsche Telekom AG

Germanys biggest provider for telecominication, internet, tv etc.
loled

[pH33n1x<3]

Originally Posted by Nezekan

some of them are directly from ip providers, not from normal ISPs, also some are from company networks. That's a very weird mix...

Yeah.

[victorsalido]

Add: 134.106.217.51 , 61.183.1.14 and 213.163.94.25 to the list if you want

[Haze*]

Originally Posted by ♯ᵜBraveSlaveᵜ♯

I've known who sends attacks on large private servers he is from my friends on the internet and this picture of send attacks to overlimit

A cat is fine too. Bakemonogatari.

[Nezekan]

Originally Posted by Biboja

Germanys biggest provider for telecominication, internet, tv etc.
loled

it's probably just a user of their services lol

[WickedNite]

well done for finding Elder the almighty playSRO owner

78.96.147.106 - UPC Romania SRL

see ya buddy xd

[OutlawNL]

Originally Posted by WickedNite

well done for finding Elder the almighty playSRO owner

78.96.147.106 - UPC Romania SRL

see ya buddy xd

I seriously love people without brain ^^

[pH33n1x<3]

Originally Posted by WickedNite

well done for finding Elder the almighty playSRO owner

78.96.147.106 - UPC Romania SRL

see ya buddy xd

Huh, why?
The IP address is provided by a Romanian ISP. I'm not defending PlaySRO but how is that associated to the playsro admin?

[PortalDark]

Originally Posted by WickedNite

well done for finding Elder the almighty playSRO owner

78.96.147.106 - UPC Romania SRL

see ya buddy xd

you still think that PlaySRO is behind all this?

[WickedNite]

not behind EVERYTHING, but behind a few servers

[sarkoplata]

Originally Posted by pH33n1x<3

By the way, if only those IPs are attacking, is it possible to solve that by blocking these IPs in Windows Firewall?

16:33:19 An incoming packet(Allowed) Protocol: UDP, Source port: 138, Destination port: 138
ô²îâþ.Š.À.. EDEEEFFGDCCACACACACACACACACACACA. FHEPFCELEHFCEPFFFACACACACACACABN.ÿSMB%............ .................&.........è........&.V..
.... 7.\MAILSLOT\BROWSE.
.۟
.CDEV2...........
�..
Uªcdev2.

Huge attacks will get your system usage to 100% so a 'software' may become useless.

[ღ ∂ Ropp]

@ ph33n1x, yes that does work.
But you must manually continue to block the IP's from firewall, that's what we're doing .

[Nezekan]

Originally Posted by sarkoplata

Huge attacks will get your system usage to 100% so a 'software' may become useless.

exactly, if the attack exceeds a certain amount of packets per second your firewall will just crash, even a dedicated firewall has its limits. But what's even worse is that the connections flood your pipe (most servers are connected at 100mbit or 1gbit) nothing will help, since the traffic won't even reach your firewall... (and no, upgradinng to 10gbit will not help you with this)

[PortalDark]

Best way to do all this(properly) is with a hardware firewall(luck with that)
Sent from my GT-S5830L using Tapatalk 2

[Nezekan]

Originally Posted by PortalDark

Best way to do all this(properly) is with a hardware firewall(luck with that)
Sent from my GT-S5830L using Tapatalk 2

not really, a hardware firewall is not ideal to protect from DDoS attacks, depending on which model it can help against other threats, but certainly not DDoS attacks, the only thing that can actually work is a scrubbing proxy service (blacklotus, ethproxy, etc...)