虛擬主機連續2天被攻擊，主機商處理進度報導

[sd07aliang]

亞特蘭大機房開始被攻擊了

04-09-2008, 09:51 PM (美國時間)

Server network problems - DDoS

Unfortunately data center switch, where the server is connected, is down now.
We are working on this issue and we hope it will be solved in next 45-60 minutes.

似乎整個機房都出事 >_<

04-09-2008, 10:55 PM

Main shared server's IP was massively DDoS-ed, so all servers in the same rack were effectively down. We had to null-route the IP for now, inbound traffic is dropping, so all resources using dedicated IPs will be back up in minutes. We're working on fine-tuning firewalls in order to restore main IP functionality, and we'll keep you updated.

Yesterday, 01:02 AM

RS12 is up but the main ip has been null routed due to a multi-gigabit DDOS attack. We're changing the main ip now (this only affects sites using the current shared ip address).

Yesterday, 01:32 AM

We have changed main shared IP, but DNS propagation still requires time, so sites still may be offline. Also, if you use 3-rd party DNS, you'll need to update DNS data yourselves. Please submit a support ticket, we'll tell you new main IP.

Yesterday, 05:18 AM

The shared ip address on the server has changed and everything is back up. If you are still down, it's due to DNS propagation.

Yesterday, 05:25 AM

Some technical information for those interested.

This was an ICMP flood attack that peaked at 2.5Gbit/sec. This was targetted at the main server ip address and brought the server and the segment of the network it was hosted on to a halt. The main ip was null routed because it was affecting other areas of the network.

Yesterday, 05:25 AM

Another one routing issue with new main IP on datacenter level, we're working on this right now. Estimated downtime is about 10 minutes.

Yesterday, 06:44 AM

The server is finally up, we're monitoring its traffic. Please accept our apologies for repeated issues, but DDoS attack of such intensity is an extraordinary case, and we have to take non-trivial measures to mitigate it.

似乎暫時平息

Yesterday, 07:35 AM

Little addition. During DNS propagation period affected sites will show cPanel default placeholder page, please don't be surprised, your data aren't lost. It's just a temporary DNS issue.

Yesterday, 04:49 PM

DDos attack seems to have started again. We're investigating.

又開始被攻擊了

Yesterday, 09:14 PM

Now it's of SYN-flood type, not ICMP as yesterday. I had to null-route new main shared IP for now in order to get access to the server, estimated downtimeis about 30 minutes.

Yesterday, 10:55 PM

It seems I've just located target domain of this attack. Investigation is still in progress though. Web service is functional now, but may reject connections sometimes.

Today, 12:43 AM

The domain has been blocked with DNS change, but the attack was IP-targeted (attack-related overhead dropped though). Then I've tuned apache configuration and kernel parameters, and server is functional now. The attack still continues, so somtimes your sites may be slow, but they're opening. Overall server traffic dropped from 10-15 Mbit/s (today's early morning, packet loss up to 70%) to 4-5 Mbps, the server is interactive enough o consider networking problems as resolved.
I'm still monitoring the server though.

Today, 06:08 AM

At present we are experiencing new DDos attack on the main shared IP of the server.
The ETA is 60 minutes.
We are doing our best to resolve it as soon as possible.
We do apologize for the inconveniences you facing at the moment.

新型態 DDos 攻擊？還是技術水平.........

Today, 09:37 AM

Unfortunately our server is still under DDos attack. IP 63.247.95.66 has been null-routed.
We are doing our best to resolve it but the type of the attack does not allow us to block it by any available means. We should wait some time.

Also any type of ICMP protocol has been blocked on server IPs

心得：是否主機商的硬體設備不足以應付這種DDOS攻擊？是不是該搬家？