Quote from: zTOPNOTCHz on February 16, 2013, 07:17:53 pm

Quote from: HappyguyForum on February 16, 2013, 07:11:23 pm

Quote from: HappyguyForum on February 16, 2013, 05:12:32 pm

the staff don't need a anit-ddos ... they need to TAKE CARE OF THE SOURCE. And by source i mean the people hitting us over and over and over. The staff are smart enough to do just that.

no, i am implying that we need to either confront them about it, or take legal action.

Here is the thing though, do they have money to take legal action and do they have the resources to track them down. . . My guess is highly unlikely. I saw we turn this project to a private project and start a screening process.

Almost make it like a private torrent site in a way. . . Just my suggestion. That way we atleast know that only 100 people have the IP and if we are still getting DDoS, we know its on the inside

nononnononono this is a open project, for the people, not for a select group. This would only allow a certain community to play and everybody would know each other and almost never see new faces. What we need to do, is only allow a certain amount of connections to the ip at once from the same ip. This person is obviously sending hundreds or thousands of connections from his ip, so to prevent this, we need to code a thing where if more than two people log in it will say "Too many connections from the same address" and this will also help the multilogging situation going on. But the solution your suggesting, could only go downhill.

I did not know this was to be an all open project so yes my suggestion there would go down hill. In this case then we should do what I suggest earlier about concurrent  Source IPs which is easily do able on either the server or the router/firewall.

I really hope they have blocked all unused ports. That is a pretty common way of DDoS. Also TCP flood as well.

Another thing they should check into is rate limit per IP source and this rate limit should include SYN FIN ACK and RST per second per source IP. They will also need to limit the concurrent connections per source IP. Another thing these DDoS attackers may be doing is sending login command at the same time.

Scripted attacks have many anomalies in their headers. This should be looked at as well.

In the logs, please be looking for similarities in the attacks. Most attackers will change parameters but they usually dont get all of the parameters and alot of these parameters remain the same across the board.

Another of the easiest solutions is start blocking IPs at the router/firewall level. Start  getting a good list together and eventually this will stop.

Worst comes to worst and they really want to stop these attacks, they can hire a specialist whose soul purpose is DDoS mitigation.

Change the server you are connecting to.

Also, pinging world1.runerebels.com did not give me that specific IP. . . Just to let you know.