URGENT: DDoS of all major NA Servers

[theDonut]

fengay stole my memes but he's a community pillar so its OK.

 

[dippindots326]

Tosh is the guy? He and I used to be friends in wfas

I guess something happened to him

 

[VinnyPooh]

having stage 5 autism

holy *** i lolled hard

 

[Froi]

if we get the ip address, tosh could go to jail.

VPN's 4 life.

We will leave the aquisition of his IP to you, my Serbian friend.  I will remove many Kebabs in your honor of you succeed.

kappa.

 

[Roberta]

He took down the PoM server, the NW_Siege server and wK_duel back to back within the hour tonight. Should get some of the NW guys to also complain as they have just as many people as us.

 

[Efe Karacar]

Contacted the hosting providers, or lust?

 

[Vissy]

If you can prove beyond reasonable doubt that it is indeed Daniel Tosh doing the DDoSing, then contacting a Staff Member is worth a shot.

The sad reality is that DDoS attacks are very easy to launch and considerably harder to defend against. There are literally guides on YouTube that tell you, step-by-step, how to DDoS. And since they generally use a pre-established botnet to launch the attack, the origin of the attack is tricky to trace. Perhaps we can try contacting Steam as well, if this Daniel Tosh has a Steam Account, to see if they can do anything about it. It's a slow way, sure, but provided that we have evidence, it's worth a shot as well.

 

[Roberta]

I did not see his name on the PoM or the wK_duel servers before they went down but a few of us were on 63e_Siege messing around and I saw him hop in the game and immediately his ping was in the 800 range. Server crashed right after.

 

[KoA John]

隐藏

They unfortunately did not stop teaming 

before anyone comments on the graphics i have a craptop but we can ignore that

Going off screen, sounds like a lonely basement kid that was spoiled by his mommy. I kinda feel bad, almost.

Also, I'm not very familiar with the laws, but I've heard ddosing is a federal crime and you can get up to 20 years in prison.

 

[Alene]

What would be this anti-DDoS protection for public servers?

 

[Nero]

What would be this anti-DDoS protection for public servers?

My soul

 

[OurGloriousLeader]

I'm no expert but I think DDoSing is a problem even for multiplayer games with massive community and server support. I don't want to say it's unfixable - I really don't know - but this is one issue that is not just a TW one.

 

[MaHuD]

With all of this attention, I am sure he/she/them won't stop doing it for a while.
Take the servers down for a while and play on other servers.

 

[MickDick]

With all of this attention, I am sure he/she/them won't stop doing it for a while.
Take the servers down for a while and play on other servers.

Um, he's just going to go to those servers and find an excuse for himself to ddos those too....  That should be obvious.

Not that you're general idea isn't logical, but if you were to really get rid of this guy you would need to completely shut down all the servers for M&B until he quits looking for them.

But that just spells death for the multiplayer community, as it will likely never recover.

 

[MaHuD]

many times servers have been DDossed, even this forum has been attacked multiple times. Nothing will change.

 

[KoA John]

Its all of our servers.

 

[captain lust]

Someone has reached out to contact me with information about any individuals that my be involved in this. Any data or evidence you have with regards to the attacks is greatly appreciated. Please send it to me via PM. Even if it just happens to be a list of dates and times when the attacks occur, although packet data including IPs is most likely to be useful. Just anything you can provide.

In the meantime, our advice remains to block all ports on the machines except the UDP ports directly used by the game servers.

 

[alden]

Someone has reached out to contact me with information about any individuals that my be involved in this. Any data or evidence you have with regards to the attacks is greatly appreciated. Please send it to me via PM. Even if it just happens to be a list of dates and times when the attacks occur, although packet data including IPs is most likely to be useful. Just anything you can provide.

In the meantime, our advice remains to block all ports on the machines except the UDP ports directly used by the game servers.

Unfortunately the only port the attacker is flooding is the UDP one required to be open to run a Warband server. The only remedy is a high end host with lots of unrestricted bandwidth and a massive CPU, both of which are more $ than most game server hosts are willing to throw at a server. Like we're talked hundreds of US dollars a month, here, because the type of UDP traffic Warband uses can't be filtered effectively, that I know of.

Perhaps any Sysadmin types might be willing to share any knowledge they might have about filtering Warband UDP traffic, or maybe could write some sort of packet inspection tool?

 

[VornOfSwag]

If you can prove beyond reasonable doubt that it is indeed Daniel Tosh doing the DDoSing, then contacting a Staff Member is worth a shot.

The sad reality is that DDoS attacks are very easy to launch and considerably harder to defend against. There are literally guides on YouTube that tell you, step-by-step, how to DDoS. And since they generally use a pre-established botnet to launch the attack, the origin of the attack is tricky to trace. Perhaps we can try contacting Steam as well, if this Daniel Tosh has a Steam Account, to see if they can do anything about it. It's a slow way, sure, but provided that we have evidence, it's worth a shot as well.

In with fire and sword (wfas) we managed to get his ip and ended up finding out his actual name. It's very easy to change ip's so I'm assuming he's already done this. After we found out his name we contacted the police, forgot what happened after that.

 

[RalliX]

I just wonder why there isn't some kind of automatic cut-off when a single address sends far, far more packets than is necessary for them to play the game. But I guess I don't know enough about these things.

Edit: In the case of most DDoS attacks, I actually imagine it would be the result of a great number of IPs sending packets.
Perhaps you could limit the number of IP which can send packets to the server to the max player count, so that each new address over the maximum number is simply ignored and shut out until a player disconnects, creating room for a new player.

Requests to connect to the server should be highest priority, so that actual players can get in.