Back online!

[brian]

Terribly sorry for the downtime - the server had to be rebooted earlier after it came under an excessive load, but it turned out that the site was actually being hit with a DDoS attack.

Basically, it involves someone directly trying to attack the server by flooding it with useless requests until the server conks out. Usually takes a bot network to do this, but attacks can seem random sometimes.

To try and cope with this the techs had to shut down the Techwatch IP while the traffic was filtered out until we only had normal traffic - unfortunately, took longer than expected.

Am going to speak to the people at the datacenter and see if there's a way to set up a firewall solution to minimise the chances of this happening again.

In the meantime, am keeping an eye on the server to see if anything unexpected comes up and can be dealt with as happens.

[ronster]

Originally Posted by brian

but it turned out that the site was actually being hit with a DDoS attack.

Thats exactley what i thought it was!
Keep up the good work Brian

[Danielle]

Script kiddies off eh? I know that hopeless feeling when your being ddos'ed how much traffic was you getting Brian?

[brian]

Terribly sorry about the downtime again - Techwatch was still being hit heavily by a DDoS attack but I'm hoping to keep the site up today.

Sincere apologies all - not happy either.

[Yorks]

I'll get the tin helmet on.

[nanochickin]

I thought VM had changed the encryption and we were flooded with cable bods again

[lee-ds]

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted, malevolent efforts of a person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root nameservers.
One common method of attack involves saturating the target (victim) machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable. In general terms, DoS attacks are implemented by either forcing the targeted computer(s) to reset, or consuming its resources so that it can no longer provide its intended service or obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.
Denial-of-service attacks are considered violations of the IAB's Internet Proper Use Policy. They also commonly constitute violations of the laws of individual nations.

Taken from Wikipedia for those interested what a DDoS is.

[pete1873]

Depending on what way they have the firewall set up and what make they should be able to do several things to stop this, these include:-

Setting the amount of concurrent from specific IP addresses, works if single or several addresses are being used but not a network of compromised machines. Also may affect legitimate traffic if lots comes from behind proxy servers.

If they are opening sessions but not completing the 3 way handshake then once again the firewall admins can reduce the time delay before clearing both half open or closed connections.

If its a good datacentre then they may have devices in front of the firewall's which respond on the http server requests to verify they are legitimate before passing the request on the actual server.

Few other things can be done but would need to know more about the attack itself.

[DAVEYEFF]

why attack the server, what do they gain? or is it just some spotty anorak in a shed getting his kicks

[Analoguesat]

Originally Posted by DAVEYEFF

why attack the server, what do they gain? or is it just some spotty anorak in a shed getting his kicks

VM????