Jump to content

Archived

This topic is now archived and is closed to further replies.

LHookins

[RESOLVED] Suspected DDOS attack

Recommended Posts

When I'm surfing the Avsim forums, I typically have a page of topics and I'll click on several of those that interest me and let them load in the background, then go and read the threads. This comes from having a somewhat slower Internet connection. While my download speeds are good, the satellite connection takes a long time to do the necessary handshaking.

 

On this visit, I've started getting messages about suspected DDOS attacks from my IP instead of the threads. I'm guessing that eventually my IP address will be banned if this keeps up.

 

I don't know if the filters have been made more sensitive today, or if more connections per page are needed, or if my IP address has been flagged.

 

I'm not really in a position to load one page at a time. Can anything be done?

 

Hook

 

And when trying to go back to the main page after posting this, I get the message again:

 

We have detected a possible DDoS attack from your IP and your access has been blocked.

 

Hook

Share this post


Link to post
Share on other sites

When I'm surfing the Avsim forums, I typically have a page of topics and I'll click on several of those that interest me and let them load in the background, then go and read the threads. This comes from having a somewhat slower Internet connection. While my download speeds are good, the satellite connection takes a long time to do the necessary handshaking.

 

On this visit, I've started getting messages about suspected DDOS attacks from my IP instead of the threads. I'm guessing that eventually my IP address will be banned if this keeps up.

 

I don't know if the filters have been made more sensitive today, or if more connections per page are needed, or if my IP address has been flagged.

 

I'm not really in a position to load one page at a time. Can anything be done?

 

Hook

 

And when trying to go back to the main page after posting this, I get the message again:

 

We have detected a possible DDoS attack from your IP and your access has been blocked.

 

Hook

 

If you try to access ten pages in 5 seconds, you will get that result. That's a pretty liberal amount, so I suggest you take a look at how many you are trying to bring up at one time. I can tell you that by implementing this, our performance has gone up tremendously.

Share this post


Link to post
Share on other sites

If you try to access ten pages in 5 seconds, you will get that result. That's a pretty liberal amount,

 

That sounds good, but I didn't access any pages when composing that message, which took a lot longer than 5 seconds. After the message was posted, which also took longer than 5 seconds, I clicked on the The Avsim Community link and got the message. Then I couldn't get into Avsim for a while.

 

Check your timings, they may not be what you intended.

 

Hm. I don't think I could click on 10 topics in 5 seconds, even if I tried. Perhaps the logic that's counting pages is off. Click on one topic, get 3 pages counted. It may also have to do with the way the satellite does handshaking, or the fact that the browser is loading lots of stuff even after the page is complete.

 

Hook

Share this post


Link to post
Share on other sites

Five seconds between mouse clicks and it still comes up, then about 20 seconds to check which pages didn't load, click on The Avsim Community and still get the error.

 

Just a heads-up in the timing issue.

 

Hook

Share this post


Link to post
Share on other sites

It may also have to do with the way the satellite does handshaking, or the fact that the browser is loading lots of stuff even after the page is complete.

 

I suspect that it is more likely that the Sat company is caching pages, and that likely is the cause. Let it settle a bit and we'll play with the thresholds.

Share this post


Link to post
Share on other sites

it is more likely that the Sat company is caching pages

 

Ah, excellent point. Thanks, Tom.

 

Hook

Share this post


Link to post
Share on other sites

Just had it myself, cleared cookies in Firefox seems fine now. Don't know if that did anything or not.

Share this post


Link to post
Share on other sites

I started getting this tonight too off and on, using Chrome on Win7.

 

Perhaps the threshold is still being adjusted?

Share this post


Link to post
Share on other sites

Happened to me earlier and I didn't open 10 tabs in 5 seconds, I had about 3 open (for longer than 5 seconds) then tried to open 3 or 4 more quickly in a subforum and I couldn't access avsim for the next five or so minutes after that.

 

Happened again but much more briefly a few minutes ago but went away (no way did I even come close to 10 tabs in 5 seconds.)

Share this post


Link to post
Share on other sites

I just got it again after opening 3 pages with a full timed 10 seconds between mouse clicks.

 

Hook

Share this post


Link to post
Share on other sites

Strange, glad I am not the only one

 

"We have detected a possible DDoS attack from your IP and your access has been blocked."

Share this post


Link to post
Share on other sites

I was about to open a topic about it. I'm having this issue myself too. Glad I'm not the only one. I usualy do the same thing Larry does. I open a few pages that interest me and leave them on the background, so that I don't forget to take a look at them. I could open a few pages one after the other without problems, but now when I open just two or three topics or forum pages in a sequence, I get the DDoS attack message.

Share this post


Link to post
Share on other sites

Might I suggest using an IP whitelist for subscribed members? Turn the filter on for all others?

 

I find Googling about various flight sim issues brings me to answers on Avsim first, might be a factor in the traffic...?

Share this post


Link to post
Share on other sites

I find Googling about various flight sim issues brings me to answers on Avsim first,

 

I gotta wonder if Google will still be able to index Avsim with the new filter.

 

Hook

Share this post


Link to post
Share on other sites

+1, just got my first couple messages, by hitting the next page while reading a topic in the forums.

Share this post


Link to post
Share on other sites

I just got this same message. I was looking at the new posts in the PMDG section. I didnt countdown the time between mouse clicks, but it definately wasnt 10 in 5 seconds. I closed the browser, and reopened it, with the same msg. After a few minutes, however, I was able to get back on.

Share this post


Link to post
Share on other sites

I have set the values a little more lenient guys, but I am going to tell you; if our performance drops off like it had, they are going to get tightened up again.

Share this post


Link to post
Share on other sites

I gotta wonder if Google will still be able to index Avsim with the new filter.

 

Hook

I wouldn't mind if Google didn't have access to AVSIM...

Share this post


Link to post
Share on other sites
Guest

I have set the values a little more lenient guys, but I am going to tell you; if our performance drops off like it had, they are going to get tightened up again.

 

I can live with the settings and even the tighter ones from earlier today if that helps overall performance: no problem at all!!! I do however object to the message that is shown... It is misleading, false and scary... I don't like to be falsely accused of being the source of a DDOS attack... DDOS attacks are NOT funny and NOT something to take lightly and hence not appropriate in the shown message. Also being told that the IP has been blocked is NOT very friendly, specially because you get the idea your IP has been blocked period (as if the block is not lifted after a few seconds). I actually feel offended by the message.

 

I would like it a lot if you change the message that is shown to something like the one you see when you try to post a few posts within a few seconds. That one simply explaines in a friendly way what's going on. The DDOS and IP blocked message is way over the top. Imho.

Share this post


Link to post
Share on other sites
The DDOS and IP blocked message is way over the top. Imho.

 

Believe me... if a person or system receives that response now with the new settings, IT WILL BE A DDOS attack and I hope like hell that the message does offend them / scare them, etc.

Share this post


Link to post
Share on other sites
Guest

Believe me... if a person or system receives that response now with the new settings, IT WILL BE A DDOS attack and I hope like hell that the message does offend them / scare them, etc.

 

LOL haha! :lol: Okay, clear. ^_^

Share this post


Link to post
Share on other sites

I've been getting these too for about the last week. Tonight, I cleared out my cookies etc. using CCleaner and reset my both my modem and wireless router.

 

I'll follow up with new DDOS messages.

Share this post


Link to post
Share on other sites

The issue discussed within this thread has been resolved. If you experience a similar issue, please make a new post referencing this issue so we may better assist you.

Share this post


Link to post
Share on other sites

×
×
  • Create New...