When playing 0ad whole network disconnects. Network otherwise stable.

[Dizaka]

Weird issue.  I can't play 0ad because of this ...

When in the 0ad lobby, or in a game, what will happen is I'll time out with a "stun endpoint error."  What will happen afterwards is that my WHOLE network will disconnect from the web.  This only happens with 0ad.

I thought maybe it's my computer.  So I formatted, did most recent windows updates, and installed 0ad.  Same thing.

 

Anyone have ideas on how to troubleshoot?  When I write the whole network disconnects I literally mean that the the whole network disconnects from the internet.  Nani experienced my disconnects when he was a host of a game I joined.  This has started recently (like late this week).  Has the network code changed for this game somehow recently?

[edit]

See this thread:

 

Edited October 9, 2020 by user1
Link thread to upload replays

[rossenburg]

user1 requested for replays, it might not be a ddos attack, even if it is...investigations starts from somewhere right?

[badosu]

Yes, @user1 requested it, does not hurt to try

[Dizaka]

Here is my only guess currently:

1)  Try playing through VPN and see if this is a DDoS attack that happens.

[Dizaka]

I went through my router logs.  The only odd thing I've found is this:

<table style="width:100%">
  <tr>
    <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th>
    <th>From: X.X.X.X:57153, </th>
    <th>to: 173.239.8.164:80, </th>
    <th>protocol: TCP	</th>
    <th>9:21 am	09/11/2020</th>
  </tr>
  <tr>
    <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th>
    <th>From: X.X.X.X:54879, </th>
    <th>to: 173.239.8.164:80, </th>
    <th>protocol: TCP	</th>
    <th>8:34 am	09/11/2020	</th>
  </tr>
  <tr>
    <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th>
    <th>From: X.X.X.X:50000, </th>
    <th>to: 213.247.47.190:80, </th>
    <th>protocol: TCP	</th>
    <th>2:43 pm 09/05/2020	</th>
  </tr>
  <tr>
    <th>Threat Management Alert 1: A Network Trojan was Detected. Signature ET MALWARE Win32/Zonebac Traffic Redirect. </th>
    <th>From: X.X.X.X:57829, </th>
    <th>to: 173.239.8.164:80, </th>
    <th>protocol: TCP	</th>
    <th>8:14 pm	09/03/2020</th>
  </tr>
</table>

Are the "to" IPs associated with any user logins?

Those "threats" are the main reasons for formatting my machine ...  It's also weird but the above logs are from around the time from when disconnects of the WHOLE network started.

 

Additionally, maybe this will be useful, but the disconnects, to date, have only happened in a "game lobby" (before a game starts but not in main chat lobby) or in a "hosted/started game."
 

Edited September 13, 2020 by Dizaka

[Dizaka]

Looking at my traffic logs for today (don't have previous logs, unfortunately) I can see that my networks gets hit with a lot of traffic in a short period of time.  This is the WAN port on my router.  I believe at around 6:00 I was in a game lobby trying to play with bbleft and bonescape(sp?)  I couldn't play as my whole internet connection went out again.

 

Note:  The traffic is over a time period of 20-25 minutes.

 

Edited September 13, 2020 by Dizaka

[badosu]

@user1 Corroborates the UDP flood hypothesis?

[Dizaka]

On 9/13/2020 around 7:10-22 p.m.  Happened again. 

 

Game hosted by Phyzik.  Ingame players were Isam_96 (1438), czar1812 (1326), _zoro_ (sleeping), anuragn (11115), and myself.

 

 

Edited September 13, 2020 by Dizaka

[Dizaka]

Played a different game with Palaigos and misc players.  Nothing happened.

[Dizaka]

Played a 1v1 vs another player.  Nothing happened.

[Dizaka]

Players ig:  thankfor pie, sabdala, furqan, randomid, Dizaka, Ivaylo_Uzunov, TheIlusiveman, Exvtheow

Specs:  Issh, Boudica, Ricsand, felixix

 

Had a minor attack (Didn't disconnect from game lobby, just game).  After I reconnected my guess is host got hit.  Game disconnected completely.  Gametime was around 11:00 am eastern time zone (US/NYC).

 

 

 

Edited September 14, 2020 by Dizaka

[smiley]

Well, call your ISP I guess. They are supposed to prevent DDoS attacks. (I guess that's dependent on the ISP, to be fair, most analytics will ignore a few gig spikes). I expect all of them to give you a comprehensive report upon request though. Or just run wireshark locally and see where it's coming from.

Sure thats not a download or something? those graphs show a very wierd DDoS attack, it instantly falls of a cliff.

Edited September 14, 2020 by smiley

[badosu]

@DizakaWhat are you using to monitor? Gonna try setting something up and see from my end too...

[Loki1950]

He appears to be using Windows default Task Monitor WireShark should give you more detailed info.

Enjoy the Choice

[smiley]

1 hour ago, badosu said:

@DizakaWhat are you using to monitor? Gonna try setting something up and see from my end too...

Looks like his router's dashboard I think.

8 minutes ago, Loki1950 said:

He appears to be using Windows default Task Monitor WireShark should give you more detailed info.

I don't think so, the windows default thing suck big time and is almost useless beyond seeing why a download is being somewhat slow.

[Dizaka]

Specing a game.  Players were felixix, Rauls, Ivayo_Uzunov, ffm, PhyZic, thankforpie, eskro141, Edwarf 

Host was randomid.

Specs were Issh, Carthage, Myself.

First disconnect was Rauls.  Rejoined game.

 

Had a conversation w/ Phyzik (approximation below):

Me:  First blood at min 18.

Him:  Happy?

Me:  No, can you smile for camera?

 

......... disconnect.  Checking logs ....

 

 

This was around 4:00 pm Eastern time, US time.

 

(Courtesy jab:  Phyzik's allies resigned.)

 

Edited September 14, 2020 by Dizaka

[Dizaka]

4:16, game hosted.  

Players:

4:18 pm eastern time.:  On launch kristian disconnected.  Probably nothing.

 

(Inbetween Phyzik asks me to stop raging / get mental help. )

4:23 pm eastern time:  Kicked by randomid for lagging.  Logs below.

 

Edited September 14, 2020 by Dizaka

[Dizaka]

48 hrs of traffic on WAN port.  Showing the recent 4 disconnects by traffic peaks.

 

Edited September 14, 2020 by Dizaka

[Dizaka]

Lagged out around 4:55 Eastern Time.  Logs again show a spike in traffic.

 

Honestly, no idea who it is.  This was from a game lobby as randomid started hosting.  However, the spikes don't appear to be random/unintentional and are related to 0ad.  

Game chat provided below to list players inside the lobby.  Note, I haven't reset my public IP so I can be bombed even if the person is not in 0ad.

 

 

 

Edited September 14, 2020 by Dizaka

[Dizaka]

Actually totally offline on home network.  5:13pm.  Rejoined randomids game but immediately lagged out and internet died.  I think biggest timeframe regarding downtime.

As expected internal network works fine.  It's just an issue with WAN receiving a hug of love.

Edited September 14, 2020 by Dizaka

[Dizaka]

Still down.  Someone going for the gold medal here.

[Feldfeld]

I think you should call your ISP like @smiley suggested

Edited September 14, 2020 by Feldfeld

[Dizaka]

Actually waiting for them to call me.  I know if I call them it's not a problem really and won't take it seriously.  If they call me then they'll take it seriously and at least have a record of this in their system. 

If whoever is doing this lives in the USA they have the CFAA to worry about.

Currently still needs offline.

Back online 5:40 pm eastern time.

Edited September 14, 2020 by Dizaka

[Dizaka]

Update:

People in game (I was a spec):

 

It started around this time.  My guess the peak isn't shown b/c the person was going for an all time world record?  Guinness book of world records?

Edited September 14, 2020 by Dizaka

[Dizaka]

Tried playing a 1v1 wtih rollo.  Rollo lost connection.  People inlobby:

5:56 pm easter time.