Admin Posted March 28, 2011 Report Share Posted March 28, 2011 Hi all As you might have noticed, RWG has been either down or extremely unstable for the last 24 hours. The reason for this has been a DoS/DDoS attack, targeting our server. Early morning yesterday, I noticed a rapid increase in incoming traffic targeting our server. I do of course have tools in place that will automagically handle things like this, but a lot of these things will only work up to a certain point. After a while, the traffic was so massive that the server and all services on the server was affected. After receiving almost 1,5TB of traffc in a couple of hours, I choose to nullroute all traffic hittin our IP. Mainly this was done to protect the integrity of our data and to be able to work on the server in the backgroun, as this would free up resources on the server, since rwgforum.com and it's IP seemed to be the target. After having worked on this all through the night, we are now online again, although some of you will probably have had some DNS issues and other issues to be able to access the forum. This is due to the changes that has been done to our DNS cluster and ouor DNS setup to be able to divert traffic/nullroute traffic in a more effecient way. I have just checked out stats and we have received 2.1TB of traffic in the last 16 hours. I haven't started looking at the logs and analyzing things yet, as my main priority has been to get the forum online again and things running stable. There are a bunch of temporary solutions installed, so there might be several things that doesn't work as they are supposed to, but eventually everything will work as normal A quickshot of our bandwidth stats the last couple of days. Notice anything unusual? I'll get back to you with more updates later on. Gotta get a couple of hours slee now. PS Our bandwidth bill this month will be crazy because of this, so I'll start here by reminding you all about our donation form; http://www.rwgforum.com/index.php?app=nexus&module=clients§ion=donations Quote Link to comment Share on other sites More sharing options...
Whatever123 Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for the heads-up, t! Very much appreciated - I'll make a donation! Quote Link to comment Share on other sites More sharing options...
PeteM Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks T As always the hardest working guy on this forum... Us guys are nothing without you mate Quote Link to comment Share on other sites More sharing options...
FxrAndy Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks t Quote Link to comment Share on other sites More sharing options...
AmStaFF Posted March 28, 2011 Report Share Posted March 28, 2011 thx for the heads-up T. *edit* $20 Donation made Quote Link to comment Share on other sites More sharing options...
Watchmeister Posted March 28, 2011 Report Share Posted March 28, 2011 Great recovery as always T. When I saw that all 3 major forums were down yesterday (at least on my computer) and I add those to the huge attacks on the dealers where the forums are mentioned on the front page I begin to smell a conspiracy whether by rival dealers, the federation of Swiss watchmakers or whatever. Then again I may just be paranoid. Most importantly, great to be back. Quote Link to comment Share on other sites More sharing options...
chrgod Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for the hard work. Will make an extra donation. Quote Link to comment Share on other sites More sharing options...
StormTooper4 Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for fixing us up once more Quote Link to comment Share on other sites More sharing options...
Fi5herman Posted March 28, 2011 Report Share Posted March 28, 2011 Really appreciated! Thanks for bringing the forum up again. Quote Link to comment Share on other sites More sharing options...
thealphabeta Posted March 28, 2011 Report Share Posted March 28, 2011 Oh RWG how I've missed you Quote Link to comment Share on other sites More sharing options...
Guest zeleni kukuruz Posted March 28, 2011 Report Share Posted March 28, 2011 Nice Quote Link to comment Share on other sites More sharing options...
modelizer Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for all hard work put in keeping this place alive T! Damn, it's great to be back! Quote Link to comment Share on other sites More sharing options...
z3k0 Posted March 28, 2011 Report Share Posted March 28, 2011 Great job, as usual ... it was a bit scary waking up yesterday, and seeing that three of four rep-forums I visit are off-line regards Quote Link to comment Share on other sites More sharing options...
coolfire Posted March 28, 2011 Report Share Posted March 28, 2011 I felt lost yesterday. Feels wonderful again. Thanks again, T! Quote Link to comment Share on other sites More sharing options...
krpster Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for taking care of us t. Why do you suppose the attack occurred? I guess it is not clear to me what is to be gained by the one attacking. Just someone wanting to cause trouble? Is there no recourse with regard to bandwidth usage billing in the case of such an attack? Doesn't really seem fair when you can't control the incoming hits like that. Kind of like getting billed for incoming text messages on your mobile Quote Link to comment Share on other sites More sharing options...
vafarmer70 Posted March 28, 2011 Report Share Posted March 28, 2011 Way to go T. Quote Link to comment Share on other sites More sharing options...
PeteM Posted March 28, 2011 Report Share Posted March 28, 2011 I dont know if this is a coincidence but PT was doing the same yesterday and so was RG for me anyway everything else worked fine... If you were into conspiracies then top of the list would be its a "Swiss One" Quote Link to comment Share on other sites More sharing options...
Cats Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for your support T. Will make a donation for this month Carpe Diem Cats Quote Link to comment Share on other sites More sharing options...
Admin Posted March 28, 2011 Author Report Share Posted March 28, 2011 I have no idea why anybody would target us for an attack. The only thing I can tell you for sure is that it isn't any legal businesses that use these methods and I really don't see what anybody would have to gain by shutting the forums down. Just doing some research before I catch a couple of hours of zzZZzz and as anybody who have experienced an attack like this, it is almost impossible to point any fingers and say "YOU did it" or the attack came from THERE!". If it is a simple DoS, it is easier to both divert the attack and see where it came from, since these attacks usually originate from few sources. When it comes to a distributed attack (DDoS), it is almost impossible, as th attacker usually uses infected computers, spread around the world, to attack. @krpster I truly agree with you on the bandwidth issue and I have of course contacted our datacenter about this. We have a fairly big setup there, so I hope they will be able to recognize that this is not something that happens to a lot and we usually stay under our contractual bandwidth allowance. Quote Link to comment Share on other sites More sharing options...
armandlefou Posted March 28, 2011 Report Share Posted March 28, 2011 Sure, try to negociate with the provider, RWG cannot pay for each attack we could support... Its obvious that its not the usual traffic.. Thanks for your hard work then Will make an extra donation Quote Link to comment Share on other sites More sharing options...
Zapadeus Posted March 28, 2011 Report Share Posted March 28, 2011 Admin please help: I am either refused to edit my sales thread (gen. Omega Seamaster) quote "You do not have permission for this action" unquote or, when the system recognizes me, I got a scrambled text in the preview, so that I better aborded the action. I just wanted to drop the price. I pressume, that this is due to your preliminary measures to get the system running again ? Quote Link to comment Share on other sites More sharing options...
Noel Fleischer Posted March 28, 2011 Report Share Posted March 28, 2011 Thanks for the help. RG still seems to be down. I'm having trouble logging into the major dealers as well. Probably the Swiss Federation?! Quote Link to comment Share on other sites More sharing options...
Whatever123 Posted March 28, 2011 Report Share Posted March 28, 2011 I'm experiencing some issues, too. Got kicked out several times and couldn't log in again. After restarting the browser it worked again - but not for long.... Well, no problem - I'm happy RWG is up again and I'm sure the issues will be resolved soon (after admin has had a couple of hours sleep... lol). Oh by the way - $25 donation made (through someone else though). Quote Link to comment Share on other sites More sharing options...
jmb Posted March 28, 2011 Report Share Posted March 28, 2011 It looks very suspicious that the "big three" would be whacked at the same time. The only ones who would have anything to gain would be the "gen boyz" and it would not surprise me if they were at the root of it. Poor RWI was the first to come back up and about 4 out of 5 times I tried accessing a page yesterday evening I got a "server too busy" error! Quote Link to comment Share on other sites More sharing options...
hiker01 Posted March 28, 2011 Report Share Posted March 28, 2011 Holy Crap T, I don't envy you right now, but more power to 'ya! Thanks for all the hard work! Here's my Angel watching over you to keep you inspired: Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.