Crystal Web ADSL performance feedback thread Part 3...

Status
Not open for further replies.
DJ... said:
Actually I'm seeing major DDOS events happening. Just hit my home, our one test line, and seeing it hitting randomly across the client-base. Trying to see what we can do to stop it, but in essence it is hitting home routers rather than the core network necessarily, so not all that much we can necessarily do on our side short of blocking a ton of stuff that would catch normal services too.

If you test, you'll see the latency coming in from your modem-router in all likelihood. Best bet is to switch off for 10min to force a new IP lease. The support staff cannot do this for you as the Telkom exchange dishes out the IP addresses from pools we provide them with.

EDIT: may even be coming from the Telkom side of things. Busy investigating now but it's an odd one. Either major DDOS activity or Telkom performing nationwide system changes and updates which we cannot find on the notice board...
Click to expand...

Takealot seemed to be having major issues today - and that was from my work. Maybe even news24. Any reason why?
 
aktor said:
Yup, it's hitting my router. Pinging from PC to router even times out. Something's hammering this router HARD from outside.
Click to expand...

As a total ignoramus, how does a DDOS hit a home router? I thought it was trojans or malware taking over many PC's to "bomb" a specific site?
 
Seems there's a lot of DDOS activity taking place. I cannot speak for those sites nor explain why they were having issues but there's certainly a concerted effort at the moment from certain groups hitting SA businesses and end users. There's very little one can do short of capturing the packets on your end using something like wireshark and setting your router to drop all connections to and from the source of the attacks. There's no specific guide I can provide as each router will operate differently, but you'll do this in the security or firewall section of your device once you know the source. From what I can pick up it's coming from multiple locations and IPs though...
 
Splinter said:
As a total ignoramus, how does a DDOS hit a home router? I thought it was trojans or malware taking over many PC's to "bomb" a specific site?
Click to expand...
They just hit your IP on vulnerable ports and mask the traffic to appear legit, and bypass ordinary DDOS mitigation ISPs employ. If they know how your mitigation works, which is not too difficult to understand as there are industry standards and products for this, then they can hit your router by simply going through random or targeted IPs and bypass the mitigation systems employed so the traffic reaches you and your modem accepts it...
 
Last edited:
DJ... said:
They just hit your IP on vulnerable ports and mask the traffic to appear legit, and to bypass ordinary DDOS mitigation ISPs employ. If they know how your mitigation works, which is not too difficult to understand as there are industry standards and products for this, then they can hit your router by simply going through random or targeted IPs and bypass the mitigation systems employed so the traffic reaches you and your modem accepts it...
Click to expand...

I will pretend I understand this.... :p

I have "Kaspesrky Total Security"; which I update every day I come online. Would this help?
 
Splinter said:
I have "Kaspesrky Total Security"; which I update every day I come online. Would this help?
Click to expand...

No, it won't I'm afraid. It's not an attack on your PC but instead on your connection established by your modem-router. So the attack sits "before" your antivirus. You need a dedicated firewall or a properly configured firewall to sort this sort of thing out on your end. It is, unfortunately, becoming a more frequent issue and SA end users are being targeted...
 
DJ... said:
No, it won't I'm afraid. It's not an attack on your PC but instead on your connection established by your modem-router. So the attack sits "before" your antivirus. You need a dedicated firewall or a properly configured firewall to sort this sort of thing out on your end. It is, unfortunately, becoming a more frequent issue and SA end users are being targeted...
Click to expand...
Hi DJ,

Just curious: What makes you say that SA end users are being targeted? Have you received reports similar to Splinter? Is there a particular trend in reasons why SA users are being targeted? Why would hackers go through all the effort for (possibly) no gain?

Not being rude, just curious. Thanks :)
 
Enigma_ said:
Hi DJ,

Just curious: What makes you say that SA end users are being targeted? Have you received reports similar to Splinter? Not being rude, just curious. Thanks :)
Click to expand...
Yes, we have, and have seen it across the board and have been monitoring it for some time...
 
DJ... said:
What router and firmware are you using to monitor the usage? Only way to know is to capture the packets at the time they were transmitted. No way to backtrack to check on our end. The agent you spoke to earlier had a word with me and I'm going to see what I can pick up on our side for you. I'll revert if I identify anything odd or anything at all, in fact.

FYI the brief DNS issue you saw there is fixed...
Click to expand...
Thanks DJ...

Router is a TP-Link WDR4300 latest firmware.

I checked its session data logs with my PCs BitMeter OSII logs and wifi connection logs. Nothing out of the ordinary :(
 
Last edited:
Orihalcon said:
Thanks DJ...

Router is a TP-Link WDR4300 latest firmware.

I checked its session data logs with my PCs BitMeter OSII logs and wifi connection logs. Nothing out of the ordinary :(
Click to expand...

It won't pick that sort of traffic up necessarily. We're in the process of building an app to do this for our clients but it's not ready just yet to release...
 
DJ... said:
It won't pick that sort of traffic up necessarily. We're in the process of building an app to do this for our clients but it's not ready just yet to release...
Click to expand...
If the data was used from a wifi connection to it, it would log it. As it does with data used by my phone, tablet and HTPC which is on wireless.

A foreign connection would be no different.

I'm quite stumped as I went through all my router logs and no foreign MAC connected.

I would really like to know what and how started downloading at 0700. Ai.
 
Orihalcon said:
If the data was used from a wifi connection to it, it would log it. As it does with data used by my phone, tablet and HTPC which is on wireless.

A foreign connection would be no different.

I'm quite stumped as I went through all my router logs and no foreign MAC connected.

I would really like to know what and how started downloading at 0700. Ai.
Click to expand...

It's not used by a wireless connection. It simply floods the modem-router itself. I can confirm that you were DDOS'd on port 80 but there's no way for us to know what the source was as we simply don't log that sort of data, and it would be illegal for us to do so.

The DDOS attacks are still on-going and the only real solution is to employ a firewall before the modem and to block the source itself, or to drop/block the source on the modem's built-in firewalls. It's not possible for us to know which servers customers connect to that are legitimate and which aren't, nor can we make that distinction on your behalf. We do employ DDOS mitigation for the network itself, but for end user connections trying to get between you and a specific service based on what may or may not be legitimate traffic is a tricky one. These attacks flood in from various servers across various hosts from various countries and they change all of the time. The only way to identify is to use heuristics and to try to make an automated call based on legitimacy on your behalf. Easier said than done, and the legalities are a fine-line too.

What I will do is try to post a few IPs known to be targeting maliciously which you can block on your end, but only after confirmation on our side...
 
DJ... said:
It's not used by a wireless connection. It simply floods the modem-router itself. I can confirm that you were DDOS'd on port 80 but there's no way for us to know what the source was as we simply don't log that sort of data, and it would be illegal for us to do so.

The DDOS attacks are still on-going and the only real solution is to employ a firewall before the modem and to block the source itself, or to drop/block the source on the modem's built-in firewalls. It's not possible for us to know which servers customers connect to that are legitimate and which aren't, nor can we make that distinction on your behalf. We do employ DDOS mitigation for the network itself, but for end user connections trying to get between you and a specific service based on what may or may not be legitimate traffic is a tricky one. These attacks flood in from various servers across various hosts from various countries and they change all of the time. The only way to identify is to use heuristics and to try to make an automated call based on legitimacy on your behalf. Easier said than done, and the legalities are a fine-line too.

What I will do is try to post a few IPs known to be targeting maliciously which you can block on your end, but only after confirmation on our side...
Click to expand...
Oooooooo

Okay! Apologies. I was still operating under the assumption that someone accessed my wifi. That I was DDOS'd clears things up considerably!

Much thanks. Then guess that is my fault as I used a dyndns server for remote access and it was likely this service's IP that was hit I think.

Thank you DJ...!
 
Hmm hang on, do you think they could be targeting DynDNS users? I'm also affected (BADLY), and also use DynDNS.
 
DJ anything your rocket scientists need to/can do to make Netflix use the ZA CDN node?
 
Sinbad said:
DJ anything your rocket scientists need to/can do to make Netflix use the ZA CDN node?
Click to expand...
Yes, and more TBA in that respect. Right now if you're using Unotelly to source from US or UK content it will deliver from a direct interconnect in London for now. But let's face it, the streaming is already superb even from the London source...
 
what's with the log a ticket and we'll get right back to you, where's live support?
 
Status
Not open for further replies.
Back
Top
Sign up to the MyBroadband newsletter
X