[RESOLVED] Suspected DDOS attack

[LHookins 3,102]

When I'm surfing the Avsim forums, I typically have a page of topics and I'll click on several of those that interest me and let them load in the background, then go and read the threads. This comes from having a somewhat slower Internet connection. While my download speeds are good, the satellite connection takes a long time to do the necessary handshaking.

 

On this visit, I've started getting messages about suspected DDOS attacks from my IP instead of the threads. I'm guessing that eventually my IP address will be banned if this keeps up.

 

I don't know if the filters have been made more sensitive today, or if more connections per page are needed, or if my IP address has been flagged.

 

I'm not really in a position to load one page at a time. Can anything be done?

 

Hook

 

And when trying to go back to the main page after posting this, I get the message again:

 

We have detected a possible DDoS attack from your IP and your access has been blocked.

 

Hook

[Tom Allensworth 1,532]

When I'm surfing the Avsim forums, I typically have a page of topics and I'll click on several of those that interest me and let them load in the background, then go and read the threads. This comes from having a somewhat slower Internet connection. While my download speeds are good, the satellite connection takes a long time to do the necessary handshaking.

 

On this visit, I've started getting messages about suspected DDOS attacks from my IP instead of the threads. I'm guessing that eventually my IP address will be banned if this keeps up.

 

I don't know if the filters have been made more sensitive today, or if more connections per page are needed, or if my IP address has been flagged.

 

I'm not really in a position to load one page at a time. Can anything be done?

 

Hook

 

And when trying to go back to the main page after posting this, I get the message again:

 

We have detected a possible DDoS attack from your IP and your access has been blocked.

 

Hook

 

If you try to access ten pages in 5 seconds, you will get that result. That's a pretty liberal amount, so I suggest you take a look at how many you are trying to bring up at one time. I can tell you that by implementing this, our performance has gone up tremendously.

[LHookins 3,102]

If you try to access ten pages in 5 seconds, you will get that result. That's a pretty liberal amount,

 

That sounds good, but I didn't access any pages when composing that message, which took a lot longer than 5 seconds. After the message was posted, which also took longer than 5 seconds, I clicked on the The Avsim Community link and got the message. Then I couldn't get into Avsim for a while.

 

Check your timings, they may not be what you intended.

 

Hm. I don't think I could click on 10 topics in 5 seconds, even if I tried. Perhaps the logic that's counting pages is off. Click on one topic, get 3 pages counted. It may also have to do with the way the satellite does handshaking, or the fact that the browser is loading lots of stuff even after the page is complete.

 

Hook

[LHookins 3,102]

Five seconds between mouse clicks and it still comes up, then about 20 seconds to check which pages didn't load, click on The Avsim Community and still get the error.

 

Just a heads-up in the timing issue.

 

Hook

[Tom Allensworth 1,532]

It may also have to do with the way the satellite does handshaking, or the fact that the browser is loading lots of stuff even after the page is complete.

 

I suspect that it is more likely that the Sat company is caching pages, and that likely is the cause. Let it settle a bit and we'll play with the thresholds.

[LHookins 3,102]

it is more likely that the Sat company is caching pages

 

Ah, excellent point. Thanks, Tom.

 

Hook

[Muskoka 104]

Just had it myself, cleared cookies in Firefox seems fine now. Don't know if that did anything or not.

[kludger 7]

I started getting this tonight too off and on, using Chrome on Win7.

 

Perhaps the threshold is still being adjusted?

[VIPERGTSR01 22]

Happened to me earlier and I didn't open 10 tabs in 5 seconds, I had about 3 open (for longer than 5 seconds) then tried to open 3 or 4 more quickly in a subforum and I couldn't access avsim for the next five or so minutes after that.

 

Happened again but much more briefly a few minutes ago but went away (no way did I even come close to 10 tabs in 5 seconds.)

[LHookins 3,102]

I just got it again after opening 3 pages with a full timed 10 seconds between mouse clicks.

 

Hook

[flyerboy 114]

Strange, glad I am not the only one

 

"We have detected a possible DDoS attack from your IP and your access has been blocked."

[MrPlaneDriver 41]

I was about to open a topic about it. I'm having this issue myself too. Glad I'm not the only one. I usualy do the same thing Larry does. I open a few pages that interest me and leave them on the background, so that I don't forget to take a look at them. I could open a few pages one after the other without problems, but now when I open just two or three topics or forum pages in a sequence, I get the DDoS attack message.

[ryanbatc 12,812]

Me too....

[BilboBaggins 82]

Might I suggest using an IP whitelist for subscribed members? Turn the filter on for all others?

 

I find Googling about various flight sim issues brings me to answers on Avsim first, might be a factor in the traffic...?

[LHookins 3,102]

I find Googling about various flight sim issues brings me to answers on Avsim first,

 

I gotta wonder if Google will still be able to index Avsim with the new filter.

 

Hook