sfx2000
Part of the Furniture
Seeing a lot of cloudflare issues over the past hour or so...
521 and 522 errors, along with a post I was responding to - was blocked with Cloudflare suggesting i was being a bad-boy...
Interesting... (and no, I'm not being a bad-boy, seems like Cloudflare or the hosting provider is having a very bad day...)
521 and 522 errors, along with a post I was responding to - was blocked with Cloudflare suggesting i was being a bad-boy...
Interesting... (and no, I'm not being a bad-boy, seems like Cloudflare or the hosting provider is having a very bad day...)
Not just timeouts and Cloudflare stuff, but getting "your browser is blocked" responses when I try to post.
Edit: Also got the "checking your browser" when I first tried the forums earlier tonight. At about 9:00 p.m. PST, I had two different browser windows open (Chrome and IE) to SMB forums, just to see if it was a browser issue, and my Win8 computer completely locked up...totally unresponsive but I also had Task Manager open and I could see lots of disk activity and what appeared to be processes loading and unloading. So, suspecting that the site may have been compromised and carrying some sort of malware/viral crap, I immediately shutdown (actually pulled the battery and disconnected from power). Sure it wasn't a clean shutdown, but it was better than running the risk of allowing whatever may have been running in the background on my computer from continuing to wipe out files...at least that's what my paranoid mind concluded. Rebooted and it was the longest reboot I've ever experienced....maybe 10 minutes until full functionality restored. But all appears well, so who knows what caused the lockup. Probably had nothing to do with SMB's own woes.
But seriously, WTF is going on with the site over the past two days? I mean, I do appreciate DDOS attacks can be tough to deal with, but this IS a site about networks, NAS, firewalls, a bit of security, and I would therefore have assumed (perhaps naively) that it would be a bit more hardened against such attacks than some other sites that don't deal with these sorts of issues. And really, who would want to attack this site? The NK's? A band of zit-faced punks looking for "fun"?
Or maybe I just don't know squat about such things, and there's really nothing that can be done when these sorts of attackers strike. Either way, I feel horrible for T. Higgins who has done such a great job building up this site to what it is.
So, to whoever is doing the DDOS and messing with the boards and the main portions of the site, f*ck you.
Edit: Also got the "checking your browser" when I first tried the forums earlier tonight. At about 9:00 p.m. PST, I had two different browser windows open (Chrome and IE) to SMB forums, just to see if it was a browser issue, and my Win8 computer completely locked up...totally unresponsive but I also had Task Manager open and I could see lots of disk activity and what appeared to be processes loading and unloading. So, suspecting that the site may have been compromised and carrying some sort of malware/viral crap, I immediately shutdown (actually pulled the battery and disconnected from power). Sure it wasn't a clean shutdown, but it was better than running the risk of allowing whatever may have been running in the background on my computer from continuing to wipe out files...at least that's what my paranoid mind concluded. Rebooted and it was the longest reboot I've ever experienced....maybe 10 minutes until full functionality restored. But all appears well, so who knows what caused the lockup. Probably had nothing to do with SMB's own woes.
But seriously, WTF is going on with the site over the past two days? I mean, I do appreciate DDOS attacks can be tough to deal with, but this IS a site about networks, NAS, firewalls, a bit of security, and I would therefore have assumed (perhaps naively) that it would be a bit more hardened against such attacks than some other sites that don't deal with these sorts of issues. And really, who would want to attack this site? The NK's? A band of zit-faced punks looking for "fun"?
Or maybe I just don't know squat about such things, and there's really nothing that can be done when these sorts of attackers strike. Either way, I feel horrible for T. Higgins who has done such a great job building up this site to what it is.
So, to whoever is doing the DDOS and messing with the boards and the main portions of the site, f*ck you.
Last edited:
This type of attack is expensive to deal with if you aim for a reasonable uptime, in terms of bandwidth, hardware power (so that the site can sustain thousands of simultaneous http, php (-fpm?) and sql connections), ISP support (backbone-level filtering as well as local filtering) and different additional services which can help, more or less (F5, Cloudflare etc).
So a donation would help the site more than being mad at the guys who run it.
So a donation would help the site more than being mad at the guys who run it.
The "Checking Your Browser" messages come from CloudFlare, which is a CDN that also has features to help mitigate DDOS.
I am working with my hosting partner, Eboundhost, who has been a tremendous help, to try to keep running despite the attack. Although you are still seeing outages they are becoming, I hope, more temporary. We are continuing to work on this and I hope things will improve.
Small networking knowledge is one thing; dealing with DDOS is quite another. Yes, it can be dealt with given enough time and $, neither of which I have in abundance.
I am working with my hosting partner, Eboundhost, who has been a tremendous help, to try to keep running despite the attack. Although you are still seeing outages they are becoming, I hope, more temporary. We are continuing to work on this and I hope things will improve.
Small networking knowledge is one thing; dealing with DDOS is quite another. Yes, it can be dealt with given enough time and $, neither of which I have in abundance.
One big problem with DDOS vs a simple DOS is you can't just block the source - the connections attempts come from a large number of separate sources. Figuring out what's a legitimate connection versus one of a thousand zombies trying to connect to you simultaneously - not simple. You can sometime block them through pattern matching, but not always.
@Tim: got my mail about another potential vector?
@Tim: got my mail about another potential vector?
So a donation would help the site more than being mad at the guys who run it.
No one is mad at anyone who runs this site. Please re-read what I wrote. The only people I'm angry with are the ones behind the DDOS attack. If Tim Higgins needs a donation, I'm happy to make one. All he has to do is ask and I'm sure many people who use this site and appreciate it will contribute.
Last edited:
Ford Prefect
Senior Member
...I am still getting the cloudflare warning and occasional captcha when visiting from my home broadband line.
That may continue for a few more days while I adjust CloudFlare settings.
Sorry for the inconvenience, but the attack continues...
NGRhodes
Regular Contributor
Tim,
You can also suggest using pastebin - http://pastebin.com/ for sharing bits of code.
Cheers, Nick
You can also suggest using pastebin - http://pastebin.com/ for sharing bits of code.
Cheers, Nick
sinshiva
Very Senior Member
leave the forum as-is
Thanks Admin
Tim, Admin,
Just wanted to say thanks.
Thanks for offering this site as a valuable resource to share and exchange ideas and experience.
And recently thanks for your efforts and perseverance in fighting through the recent site issues and recovery.
Your efforts are appreciated.
Happy Holidays and New Year.
Tim, Admin,
Just wanted to say thanks.
Thanks for offering this site as a valuable resource to share and exchange ideas and experience.
And recently thanks for your efforts and perseverance in fighting through the recent site issues and recovery.
Your efforts are appreciated.
Happy Holidays and New Year.
System Error Message
Part of the Furniture
One fun way to deal with DDOS with minimal downtime is
http://en.wikipedia.org/wiki/Tarpit_(networking)
If any machine tries to initiate too many connections or packets using this in firewall can help to reduce the impact of DDOS. I have tested it and found it to be effective in slowing DDOS significantly. When i got attacked by advertisement botnets that firewall rule reduced the attack from MB/s (saturated internet) to a few packets per second. The only downside is that it works on TCP only but it does well against brute forcing too.
One problem we have is that too many people have unsecured devices that are easily broken into or having backdoors that they tend to be used as part of botnets.
Not sure if smallnetbuilder is hosted on a service or virtual machine that they can configure. Cloudfare sounds like they have many machines. They should have the resources to handle web browsing from the entire world.
http://en.wikipedia.org/wiki/Tarpit_(networking)
If any machine tries to initiate too many connections or packets using this in firewall can help to reduce the impact of DDOS. I have tested it and found it to be effective in slowing DDOS significantly. When i got attacked by advertisement botnets that firewall rule reduced the attack from MB/s (saturated internet) to a few packets per second. The only downside is that it works on TCP only but it does well against brute forcing too.
One problem we have is that too many people have unsecured devices that are easily broken into or having backdoors that they tend to be used as part of botnets.
Not sure if smallnetbuilder is hosted on a service or virtual machine that they can configure. Cloudfare sounds like they have many machines. They should have the resources to handle web browsing from the entire world.
Last edited:
netware5
Very Senior Member
Hi, I am trying to post something and the result is the image attached. CloudFlare Ray ID: 1a88824b808c0f81.
What happens?
***EDIT*** I managed to found what is the reason. If the the words samba performance settings are in quotes the site blocks me. When I removed quotes - everything is fine.
What happens?
***EDIT*** I managed to found what is the reason. If the the words samba performance settings are in quotes the site blocks me. When I removed quotes - everything is fine.
Attachments
Last edited:
Similar threads
