Baldur's Gate : The Sword Coast Chronicles : NWN2 Persistent World

It seems to be during the EU prime time.
Usually from 16:00 to 23:00-0:00.
After that it tends to stop.
Which is rather annoying since I haven't managed to play much because of it.

If the person in question would be from the US it would be more logical to take down the server during the US prime time.

I would very much like it if the person responsible for the server being slow and unplayable would kindly cease to do whatever they are doing, thank you

Has it begun again? I'm getting stuck in the loading map screen after logging in.

Is anyone sharing a router here? I am noticing two accounts keep logging off and on, each time they do, the server stops lagging

Maverick 40 wrote:Is anyone sharing a router here? I am noticing two accounts keep logging off and on, each time they do, the server stops lagging

Follow up, now it is each time a player logs off, it jumps ahead about 10 rounds before going back to standstill lag.

Maverick 40 wrote:

Maverick 40 wrote:Is anyone sharing a router here? I am noticing two accounts keep logging off and on, each time they do, the server stops lagging

Follow up, now it is each time a player logs off, it jumps ahead about 10 rounds before going back to standstill lag.

This sounds exactly like a typical DDOS attack.

The network hub connected to the server is experiencing a massive load of traffic from multiple sources. This means the device needs to process all of those packets (literally millions, if not billions). It will do this in the order the packets were received.

When someone logs on or off the server, I imagine the network traffic associated with that action causes a temporary amount of "legitimate" traffic to pass through, meaning the actions your PC has taken, spells cast, etc are allowed through before the device continues to sift through the millions of erroneous packets of the attackers.

This is the main trouble with DDOS. The router can't differentiate between "legitimate" traffic and erroneous packets sent by attacking computers.

Tinkererer wrote:This is the main trouble with DDOS. The router can't differentiate between "legitimate" traffic and erroneous packets sent by attacking computers.

Yup. Ideally, there needs to be a sort of filter that automatically blocks IPs that generate an unnatural amount of requests towards the server.

We are still receiving a lot of DDOS traffic, yes. Particularly during European evening hours. We're working on mitigating it however we can.

If anyone is an expert in this field and would like to assist, please feel welcome to shoot us a PM.

Eldebryn wrote:

Tinkererer wrote:This is the main trouble with DDOS. The router can't differentiate between "legitimate" traffic and erroneous packets sent by attacking computers.

Yup. Ideally, there needs to be a sort of filter that automatically blocks IPs that generate an unnatural amount of requests towards the server.

Routers are built for one thing: processing network traffic I/O. Any sort of filter, or really anything that doesn't directly correlate to that function, would slow routers down.

This is the function of firewalls. Unfortunately, firewalls are difficult to configure such that DDOS attacks get mitigated because the traffic comes from different source IPs every time.

Edit: In addition to that, I should also note that the OS on 99% of routers cannot even tell what is considered "unnatural amounts" by our standards.

The router is kinda like this alien: http://stream1.gifsoup.com/view7/488646 ... rter-o.gif

I don't think Agent K is the DDOS...this analogy is going nowhere. But you get the idea.

Maecius wrote:We are still receiving a lot of DDOS traffic, yes. Particularly during European evening hours. We're working on mitigating it however we can.

If anyone is an expert in this field and would like to assist, please feel welcome to shoot us a PM.

I genuinely cannot believe that there is someone this intent on ruining an evenings entertainment.

Whoever you are - I am sure you are reading this. I would ask you to stop. It is sad to come home and want to play and develop my characters and find myself unable to do so because you have decided to hold a vendetta. Whatever vendetta you have, it is surely time for it to pass.

MopKnight wrote:Whoever you are - I am sure you are reading this. I would ask you to stop. It is sad to come home and want to play and develop my characters and find myself unable to do so because you have decided to hold a vendetta. Whatever vendetta you have, it is surely time for it to pass.

There is a pretty good chance it's nothing personal (TM.) really. Lots of people in hacking communities see systems like this one here as "puzzles". Experiments essentially in order to test what they can breach and what not, sometimes just to mess with others or simply because "I can so why not".
My uni department's forum is only used by students and some instructors, yet every so and then it becomes the target of spam bots and DDOS attacks. Point is, there may not even be a motivation beyond that.

Tinkererer wrote:Routers are built for one thing: processing network traffic I/O. Any sort of filter, or really anything that doesn't directly correlate to that function, would slow routers down. This is the function of firewalls. Unfortunately, firewalls are difficult to configure such that DDOS attacks get mitigated because the traffic comes from different source IPs every time.

Firewalls don't mitigate floods, IDS/IPS traffic shaping does. You can still mitigate to your heart's content but if the flood exceeds the bandwidth going into the machine you're going to be locked up anyways. A 1Gbps UDP flood on a 1Gbps pipe is easy to come by, we're still having problems will syn/ack flood exploits.

That said, while there's a chance that the UDP flood is likely, take a notice at the ICMP traffic that's able to still get through with nominal response time. There's a chance that pipe may not be hung up afterall.

Maecius wrote:If anyone is an expert in this field and would like to assist, please feel welcome to shoot us a PM.

Sent one a while back, still waiting.

Just two questions.
Would a password protection change anything.
Another thing is would it be possible to block the IP's from specific countries?

Also are they taking down the other realms or mainly this one?

Calen wrote:Would a password protection change anything.

Nope

Calen wrote:Another thing is would it be possible to block the IP's from specific countries?

Yeah that's not the wisest idea, besides, it's not about server's refusal of connections it's their amount that bottlenecks on provider's end, so IP bans won't help.

Tries to login...

*Shakes his head*

Wonderful this means i have time to finish some of the stuff i left behind...

Tries to login again...

I should really get started.

Tries to login again...

Please connect i don't wanna!!!