Leaderboard

Tweaked the tile color

It's a fair point. I believe that right now giving time and spending it with us on IRC is the best kind of donation that can be done if one is able to program. Money helps and is always welcome to support the hosting fees. Yeah it was a nice patch, but IIRC in the current version it doesn't work on Windows. Maybe someone will take it on in the future. We're working on https://code.wildfiregames.com/D3184 to make it harder to get IPs it won't solve everything of course, but it might make things a little better. There is also

Some Terra Magna love:

Update: added Macedonia 24 - Gaugamela (331 BC) The final showdown between Alexander and Darius is at hand. A much smaller (but much better trained) Greek and Macedonian army meets the much larger Persian forces near the village of Arbela. Darius has gathered forces from all corners of the empire, including Indian war elephants and cavalry. He rides in his chariot flanked by his most trusted soldiers as well as Greek mercenaries. As Alexander, you are in charge of the companion cavalry, as well as a few other elite units. A small force of Egyptian warriors has also decided to follow you into Persia in seek of adventure and glory. The Macedonian reserve waits back at the camp but can be signaled into action by lighting "bonfires". There are three such fires (represented as Outposts) at your disposal. The first, if lit, will send half our reserve infantry towards Craterus. The second will send the other half towards Alexander. The third will let the reserve cavalry known to join the fight and head towards Alexander. You can "light" each bonfire by clicking on the outpost and then destroying it (press the 'Del' key on the keyboard or click the skull button under the building description). Also, this one uses k-means clustering

Do not split community with different lobbies ;/. A lot of players in 0ad but not enough for multiple multiplayer lobbies.

It's every single TG on regular hours on every single day of the week! Really, nobody can play a TG on regular hours anymore. It's not a sporadic issue.

Can confirm he couldn't rejoin. I was using mobile data and stun which makes ddosing the host (me) more hard/ineffective so he probably went for @Grapjas. I recommend people to use mobile tethering with data enabled for when playing a 0ad game as it seems to deter the attacker.

Couldnt reconnect to said game at all too (EDIT: After getting DDos), straight up dc'd me and server refuses connection for a while. commands.txtmetadata.json

Being Ddos'd into oblivion as we speak. Was playing in @nani 's game. The usual thing, can't do anything for a few mins outside of 0ad too. Cannot even connect to the lobby for a good while even though internet works again. Network showing spikes too. commands.txtmetadata.json

Highly likely the attacks are manual with the person idling in chat on one of the accounts. I believe game time vs idle time in the multiplayer lobby should be monitored. Players who have extensive idle time in relation to games should be kicked and/or banned from lobby. I mean like 12-24 hrs online without starting and/or playing a game. Maybe this could be "nullified" if players are vetter somehow such as the application to be a dev/contributor. Around/after 10:00 pm U.S. Easter Time a lot of this subsides and you can play games. This sort of supports the theory that the attacks are manual. Additionally, the attacks are dynamic. When the attacks are not working different types of attacks are utilized. There are the standard ICMP/UDP packet attacks and they have sometimes been switched to NTP attacks.

1. Multiple hosts and players with hardware or software monitoring were able to see extremely high loads unrelated to the game itself, happens only when playing 0ad. Most notably one can see on aforementioned Dizaka thread. 2. Regular connection issues 3. Extremely high load when playing 0ad, sometimes shutting off all of the user's networking. 4. Good question, I'd like to see that. The best way is to have hardware monitoring capabilities, though some seem to have been able to track via tcpdump 5. Same as above, still not fully described, but Dizakas insights are relevant here. 6. .. 7 ..

1. That's a good question, it seems attacker sends packets that look like NTPv2 packets so pattern matching on that could help but they can change approach. No extensive (public) investigation on the attack was performed yet AFAIK tho. 2. It can, as I said on short term a tutorial on how to defend yourself is one short term attempt. Unfeasible though for non technical-savvy players.

.

I feel like one of the obstacles to donating is the lack of direction, it is kinda unknown, one feels uneasy to donate when you don't know exactly how that will be used. Sure, server for bots, site, SSL certs maybe etc. but at least having a defined goal for the future and how that money could help would be nice. This is both a good and bad example, a donation encouraging a change but at the same time that change becoming stale (a much needed one btw): https://code.wildfiregames.com/D1746 If it encouraged the team to make a change to the infrastructure that not only mitigated DoS attacks but promoted the use of dedicated servers, I would certainly feel extremely compelled to donate.

I like it

Related topics "DDOS"? By @Emperior, May 26, 2019 in Help & Feedback Strange disconnection issue. [PLEASE UPLOAD REPLAYS] By @user1, June 11, 2020 in Help & Feedback When playing 0ad whole network disconnects. Network otherwise stable. By @Dizaka, September 2, 2020 in Gameplay Discussion Nedris (currently 1422) will DDOS without you pissing him off directly By @JohnDoe2, October 13, 2020 in General Discussion Attacks on 0ad (suspected DoS/DDoS) By @BoredRusher, November 26, 2020 in Bug reports Are you aware of the scale of DoS attacks? By @badosu, December 6, 2020 in Game Development & Technical Discussion

That's some sweet work!

> Is there a way to make some functionality to deregister from lobby after game starts? That could help. This is possible, in fact it is even possible to hack some naive way into the A23 lobby. Note to someone coding it: make sure dropped players can return. Late observers maybe less important. @badosuto do this one needs to adapt the lobby bots: only send the games which satisfy certain conditions to the clients. To actually implement it in the lobby, we should update the lobby bots we run. I am not able to do this but I guess user1 can (and otherwise I can ping other ppl). I think the easiest way to propose the change is making a phab revision with the changes (a mod won't work for this issue, since we need to change the serverside). Also a proactive ddos'er can still store the ip's of games being hosted and kill them when they disappear (obviously it will make it harder for the ddos'er).

From your graphs, it looks like the router is being overloaded with packets, not necessarily bandwidth. A million tiny packets on a home router would still starve it. All this need in an interface to do. Alternatively, proxy the requests done through the lobby. That way, the DDoSer would need to connect to the host before he can get a public IP. Basically, don't advertise public IPs, just relay them to the actual host when they want to connect.

To an extent this won't work if your ISP provides a public IP. DDOS is performed on all/random ports. Goal is to choke the pipe to prevent any bandwidth from getting out. It's a sufficient choke of the bandwidth to bring down a 200 mbit connection. @aixo

Seriously devs, please get on this. It's destroying the community and everything that your team built.

Tag @user1 Please state your lobby username and the lobby username of the offending player. my name: weirdJokes username of offending player: tato98c He just quit in a lost situation. What's the point of not counting matches where the opponent has left - since more than x minutes - as won? On the chess website Lichess it goes like this, it's essential rule on the site. Shouldn't it also be applied here? commands.txt

And I'm back with another 1v1

Judging nowadays society, 0 A.D must change all actors into genderless, non-binary Humans soon.

1) Kristian solo disconnect. Either a potatoe for a PC or ... . Previously, and in general, his potatoe PC doesn't have issues with his games. 2) Kristian/Cesar duo disconnect. Game ended afterwards. No sure if Cesar/Kristian or other team was winning or whether it was close to end of game. Was banned by Phyzik for being a silent spec. Don't have replay on what happened.

Cesar did: Then he disconnected twice: 1: 2: Note: Wouldn't have posted if he'd have disconnected just once.

Wasn't really on ... But something happened here around 9:45 pm. Checked with family and no one really did anything. Hoping that no machine is compromised.

9:13 pm eastern time, or so. Finished a 4v4. No lag. No disconnects. None.

8:32 pm eastern time, or so. Finished a game 4v4. No lag. No disconnects. None.

6:57: dpikt lagging in another game. Users: Global chat: Update: Seems like Ricsand became lagsand? Looks like lagsand 2x.

Yeah, it's looking like malicious behavior from what we've seen so far

Tried playing a 1v1 wtih rollo. Rollo lost connection. People inlobby: 5:56 pm easter time.

Update: People in game (I was a spec): It started around this time. My guess the peak isn't shown b/c the person was going for an all time world record? Guinness book of world records?

Actually waiting for them to call me. I know if I call them it's not a problem really and won't take it seriously. If they call me then they'll take it seriously and at least have a record of this in their system. If whoever is doing this lives in the USA they have the CFAA to worry about. Currently still needs offline. Back online 5:40 pm eastern time.

Lagged out around 4:55 Eastern Time. Logs again show a spike in traffic. Honestly, no idea who it is. This was from a game lobby as randomid started hosting. However, the spikes don't appear to be random/unintentional and are related to 0ad. Game chat provided below to list players inside the lobby. Note, I haven't reset my public IP so I can be bombed even if the person is not in 0ad.

48 hrs of traffic on WAN port. Showing the recent 4 disconnects by traffic peaks.

4:16, game hosted. Players: 4:18 pm eastern time.: On launch kristian disconnected. Probably nothing. (Inbetween Phyzik asks me to stop raging / get mental help. ) 4:23 pm eastern time: Kicked by randomid for lagging. Logs below.

Specing a game. Players were felixix, Rauls, Ivayo_Uzunov, ffm, PhyZic, thankforpie, eskro141, Edwarf Host was randomid. Specs were Issh, Carthage, Myself. First disconnect was Rauls. Rejoined game. Had a conversation w/ Phyzik (approximation below): Me: First blood at min 18. Him: Happy? Me: No, can you smile for camera? ......... disconnect. Checking logs .... This was around 4:00 pm Eastern time, US time. (Courtesy jab: Phyzik's allies resigned.)

Looks like his router's dashboard I think. I don't think so, the windows default thing suck big time and is almost useless beyond seeing why a download is being somewhat slow.

@DizakaWhat are you using to monitor? Gonna try setting something up and see from my end too...

Well, call your ISP I guess. They are supposed to prevent DDoS attacks. (I guess that's dependent on the ISP, to be fair, most analytics will ignore a few gig spikes). I expect all of them to give you a comprehensive report upon request though. Or just run wireshark locally and see where it's coming from. Sure thats not a download or something? those graphs show a very wierd DDoS attack, it instantly falls of a cliff.

Players ig: thankfor pie, sabdala, furqan, randomid, Dizaka, Ivaylo_Uzunov, TheIlusiveman, Exvtheow Specs: Issh, Boudica, Ricsand, felixix Had a minor attack (Didn't disconnect from game lobby, just game). After I reconnected my guess is host got hit. Game disconnected completely. Gametime was around 11:00 am eastern time zone (US/NYC).

On 9/13/2020 around 7:10-22 p.m. Happened again. Game hosted by Phyzik. Ingame players were Isam_96 (1438), czar1812 (1326), _zoro_ (sleeping), anuragn (11115), and myself.

I went through my router logs. The only odd thing I've found is this: <table style="width:100%"> <tr> <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th> <th>From: X.X.X.X:57153, </th> <th>to: 173.239.8.164:80, </th> <th>protocol: TCP </th> <th>9:21 am 09/11/2020</th> </tr> <tr> <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th> <th>From: X.X.X.X:54879, </th> <th>to: 173.239.8.164:80, </th> <th>protocol: TCP </th> <th>8:34 am 09/11/2020 </th> </tr> <tr> <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th> <th>From: X.X.X.X:50000, </th> <th>to: 213.247.47.190:80, </th> <th>protocol: TCP </th> <th>2:43 pm 09/05/2020 </th> </tr> <tr> <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th> <th>From: X.X.X.X:57829, </th> <th>to: 173.239.8.164:80, </th> <th>protocol: TCP </th> <th>8:14 pm 09/03/2020</th> </tr> </table> Are the "to" IPs associated with any user logins? Those "threats" are the main reasons for formatting my machine ... It's also weird but the above logs are from around the time from when disconnects of the WHOLE network started. Additionally, maybe this will be useful, but the disconnects, to date, have only happened in a "game lobby" (before a game starts but not in main chat lobby) or in a "hosted/started game."

Yes, @user1 requested it, does not hurt to try

user1 requested for replays, it might not be a ddos attack, even if it is...investigations starts from somewhere right?

Ideas for stuff

@wowgetoffyourcellphone: Something like https://trac.wildfiregames.com/ticket/4126 (disclaimer: it's a draft)

Still down. Someone going for the gold medal here.

Looking at my traffic logs for today (don't have previous logs, unfortunately) I can see that my networks gets hit with a lot of traffic in a short period of time. This is the WAN port on my router. I believe at around 6:00 I was in a game lobby trying to play with bbleft and bonescape(sp?) I couldn't play as my whole internet connection went out again. Note: The traffic is over a time period of 20-25 minutes.