Whats going on with the forums ??

[wh7qq]

Got into the forum after a scary looking page that said something about "checking your router". I was afraid I was getting attacked by Martians. It went away and I can't get it back for a better look. Sorry you are experiencing such a PITA.

 

[sfx2000]

Seeing a lot of cloudflare issues over the past hour or so...

521 and 522 errors, along with a post I was responding to - was blocked with Cloudflare suggesting i was being a bad-boy...

Interesting... (and no, I'm not being a bad-boy, seems like Cloudflare or the hosting provider is having a very bad day...)

 

[stevech]

after midnight in PT zone, there was a lot of outage at the server. Sometimes it tossed up a web page saying "server too busy, try later". Mostly, just timeouts.

 

[jegesq]

Not just timeouts and Cloudflare stuff, but getting "your browser is blocked" responses when I try to post.

Edit: Also got the "checking your browser" when I first tried the forums earlier tonight. At about 9:00 p.m. PST, I had two different browser windows open (Chrome and IE) to SMB forums, just to see if it was a browser issue, and my Win8 computer completely locked up...totally unresponsive but I also had Task Manager open and I could see lots of disk activity and what appeared to be processes loading and unloading. So, suspecting that the site may have been compromised and carrying some sort of malware/viral crap, I immediately shutdown (actually pulled the battery and disconnected from power). Sure it wasn't a clean shutdown, but it was better than running the risk of allowing whatever may have been running in the background on my computer from continuing to wipe out files...at least that's what my paranoid mind concluded. Rebooted and it was the longest reboot I've ever experienced....maybe 10 minutes until full functionality restored. But all appears well, so who knows what caused the lockup. Probably had nothing to do with SMB's own woes.

But seriously, WTF is going on with the site over the past two days? I mean, I do appreciate DDOS attacks can be tough to deal with, but this IS a site about networks, NAS, firewalls, a bit of security, and I would therefore have assumed (perhaps naively) that it would be a bit more hardened against such attacks than some other sites that don't deal with these sorts of issues. And really, who would want to attack this site? The NK's? A band of zit-faced punks looking for "fun"?

Or maybe I just don't know squat about such things, and there's really nothing that can be done when these sorts of attackers strike. Either way, I feel horrible for T. Higgins who has done such a great job building up this site to what it is.

So, to whoever is doing the DDOS and messing with the boards and the main portions of the site, f*ck you.

 

[BWR]

This type of attack is expensive to deal with if you aim for a reasonable uptime, in terms of bandwidth, hardware power (so that the site can sustain thousands of simultaneous http, php (-fpm?) and sql connections), ISP support (backbone-level filtering as well as local filtering) and different additional services which can help, more or less (F5, Cloudflare etc).

So a donation would help the site more than being mad at the guys who run it.

 

[thiggins]

The "Checking Your Browser" messages come from CloudFlare, which is a CDN that also has features to help mitigate DDOS.

I am working with my hosting partner, Eboundhost, who has been a tremendous help, to try to keep running despite the attack. Although you are still seeing outages they are becoming, I hope, more temporary. We are continuing to work on this and I hope things will improve.

Small networking knowledge is one thing; dealing with DDOS is quite another. Yes, it can be dealt with given enough time and $, neither of which I have in abundance.

 

[thiggins]

Tapatalk temporarily disabled

We're seeing exploits on Tapatalk. So until this attack is over, it's disabled.

 

[RMerlin]

One big problem with DDOS vs a simple DOS is you can't just block the source - the connections attempts come from a large number of separate sources. Figuring out what's a legitimate connection versus one of a thousand zombies trying to connect to you simultaneously - not simple. You can sometime block them through pattern matching, but not always.

@Tim: got my mail about another potential vector?

 

[thiggins]

I think things should be back to normal. Thanks for hanging in there.

 

[jegesq]

So a donation would help the site more than being mad at the guys who run it.

No one is mad at anyone who runs this site. Please re-read what I wrote. The only people I'm angry with are the ones behind the DDOS attack. If Tim Higgins needs a donation, I'm happy to make one. All he has to do is ask and I'm sure many people who use this site and appreciate it will contribute.

 

[Ford Prefect]

I think things should be back to normal. Thanks for hanging in there.

...I am still getting the cloudflare warning and occasional captcha when visiting from my home broadband line.

 

[thiggins]

...I am still getting the cloudflare warning and occasional captcha when visiting from my home broadband line.

That may continue for a few more days while I adjust CloudFlare settings.

Sorry for the inconvenience, but the attack continues...

 

[john9527]

Tim

Looks like you were able to recover a good part of the forum after the 12-18 reset. I'm sure it wasn't easy, and just wanted to say 'good job' and 'thanks'!

 

[thiggins]

TapaTalk iOS problems?

Anyone having trouble using TapaTalk on iOS? I've got a report of it crashing iOS when trying to access SNB forums.

 

[hizzo3]

I recently created a new acct and was having issue because Tapatalk was trying to log in using the acct info that was lost. But I was able to fix that by recreating my acct. Android.

 

[NGRhodes]

Tim,

You can also suggest using pastebin - http://pastebin.com/ for sharing bits of code.

Cheers, Nick

 

[sinshiva]

Anyone having trouble using TapaTalk on iOS? I've got a report of it crashing iOS when trying to access SNB forums.

leave the forum as-is

 

[kenhlan]

Thanks Admin

Tim, Admin,

Just wanted to say thanks.

Thanks for offering this site as a valuable resource to share and exchange ideas and experience.

And recently thanks for your efforts and perseverance in fighting through the recent site issues and recovery.

Your efforts are appreciated.

Happy Holidays and New Year.

 

[System Error Message]

One fun way to deal with DDOS with minimal downtime is
http://en.wikipedia.org/wiki/Tarpit_(networking)
If any machine tries to initiate too many connections or packets using this in firewall can help to reduce the impact of DDOS. I have tested it and found it to be effective in slowing DDOS significantly. When i got attacked by advertisement botnets that firewall rule reduced the attack from MB/s (saturated internet) to a few packets per second. The only downside is that it works on TCP only but it does well against brute forcing too.

One problem we have is that too many people have unsecured devices that are easily broken into or having backdoors that they tend to be used as part of botnets.

Not sure if smallnetbuilder is hosted on a service or virtual machine that they can configure. Cloudfare sounds like they have many machines. They should have the resources to handle web browsing from the entire world.

 

[netware5]

Hi, I am trying to post something and the result is the image attached. CloudFlare Ray ID: 1a88824b808c0f81.

What happens?

***EDIT*** I managed to found what is the reason. If the the words samba performance settings are in quotes the site blocks me. When I removed quotes - everything is fine.