DDoS: See something, say something

[Norse_Harold]

According to lobby chat today, two games were ddosed. Some people had guesses about who was responsible. I think that some people have information that could be useful for tracking down who is responsible. Please don't be silent about it. If you prefer then you can share tips about ddos suspects privately with me and/or other WFG staff.

Here's a thread with an example of the evidence that can be collected and published surrounding ddos events.

Here's a thread about trying to make lobby bans effective.

If you're frustrated with how things are going, please contribute in similar ways.

Edited November 12, 2022 by Norse_Harold

[Yekaterina]

Good ideas.

I have never been DDOSed when I was hosting on Eduroam. This might be useful for your investigation. 

When I am at home, using a network provider called SKY, it happened only twice in hundreds of games. I had never had an error since I changed my IP address. That might be helpful for hosts who experience frequent DDOS. 

https://eduroam.org/

But:

1. Are you sure what you are experiencing is DDOS and not some bad network connection to the host? Many people play over a VPN and you probably know how unstable VPNs can be. Some countries just have poor internet providers and timeouts are frequent. On the surface it will look like a DDOS but really it isn't. 

2. 0AD can run into errors with STUN points and other program imperfections. 

 

[Yekaterina]

You can look at other online games and see how they achieve real time without DDOS or suddenly closing. 

[Norse_Harold]

2 hours ago, Sevda said:

1. Are you sure what you are experiencing is DDOS and not some bad network connection to the host? Many people play over a VPN and you probably know how unstable VPNs can be. Some countries just have poor internet providers and timeouts are frequent. On the surface it will look like a DDOS but really it isn't. 

Always good to check this with each circumstance. I have traffic captures of some of the times that I have been ddosed showing maximum packet rates for the network link of either unsolicited NTP responses or DNS responses from many unique IP addresses. And, people can read past descriptions of the secondary symptoms like a high activity LED blinking on the modem despite total inability to access the Internet.

If anyone wants assistance with setting up a way to capture network traffic or otherwise diagnose whether a ddos happens, contact me. And, please make it before you get ddosed again, not during a ddos...

[Ginnungagap]

Yesterday evening (UTC) while hosting games i received the heartwarming gift of millions of packets from around the world tried to be delivered in a short period of time, which you also would call a DDOS attack.

[Stan`]

14 hours ago, Sevda said:

You can look at other online games and see how they achieve real time without DDOS or suddenly closing. 

Minecraft uses dedicated servers.

[Ginnungagap]

Groundhog Day. Another successfully failed game.

At the moment this screenshot was taken already more then 14 million packets from over 1500 different IP's have been delivered, which lead to i disconnection of the connected players.

[a 0ad player]

I was ddos several times in this game so team1 could win.

[sternstaub]

On 13/11/2022 at 5:21 PM, Stan` said:

Minecraft uses dedicated servers.

 

45 minutes ago, a 0ad player said:

I was ddos several times in this game so team1 could win.

Do i understand correctly that, in 0ad design, the attack can affect only a single player in a game? It would mean that each participant would be required to have their own DDoS protection, right?

[rossenburg]

13 minutes ago, sternstaub said:

the attack can affect only a single player in a game?

the host is hosting on his computer, once he's hit, everyone connected will shake too. More like a pilot and passengers - host being the pilot, anyone else connected to his game being a passenger. Unless in a case the attacker targets a specific user

Edited February 19, 2023 by rossenburg