Crystal Web DSL performance feedback thread Part 4...

[Rivin]

I'm on Vumatel ftth with CW and having the same issues this weekend.

 

[AfricanTech]

Yep - horrible issues.

PS4 NAT addressing broke - spent 2 hours mucking around with my firewall settings before eventually undoing all the changes I'd made this morning and switching to Vox - voila! everything working.

Really frustrating

 

[AfricanTech]

And it feels like they've blocked (most) UDP traffic again.

That would explain the PS4 issues...

 

[kripstoe]

My FTTH on CW died. Started having issues yesterday. Is threre a related FTTH thread for CW somewhere?

 

[kohlhtor]

I have problem with my VoIP wich not working it’s connect but no voice it works on webafrica

 

[Sinbad]

Ddos started again yesterday.

 

[kohlhtor]

It is strange no support and cw not monitoring the Network

 

[Sinbad]

It is strange no support and cw not monitoring the Network

Sunday and they are. The udp not working is a sign of the ddos mitigation

 

[kohlhtor]

Sunday and they are. The udp not working is a sign of the ddos mitigation

Yes but the problem starts last night and update on the webpage I chatted to them and to update the status their must speak to the management

 

[S.Claus]

It happens during school holidays and over weekends leading me to believe its a bunch of little kids that saw something on youtube. I would personally love to see them get caught.

 

[getafix33]

Is their news server still working. Am getting server rejection errors when trying to connect

 

[Afrikane]

My FTTH on CW died. Started having issues yesterday. Is threre a related FTTH thread for CW somewhere?

Same, from around the time my IP was switched from IS to Evonet/Crystal.....

 

[kripstoe]

Same, from around the time my IP was switched from IS to Evonet/Crystal.....

I also noticed an IP change. Support would not confirm it. Still down. Was promised feedback, but have not received anything.

 

[AfricanTech]

Is their news server still working. Am getting server rejection errors when trying to connect

Long dead - their nntp provider disappeared in the night

No replacement announced yet.

 

[Sinbad]

Same, from around the time my IP was switched from IS to Evonet/Crystal.....

Ddos started when cape Town was switched over. My guess is whoever is behind this is an insider or a customer

 

[new_in_za2]

So, my guess on what just happened:

Crystal Web (and/or their upstream providers) are trying to mitigate the attack by filtering UDP traffic. However, UDP is central to DNS, and thus some UDP traffic at least needs to be allowed.

It seems like that the person doing the DDoS attacks found a way to to use UDP packets that look like DNS requests to get their attack through the filtering, and in response Crystal Web (again, and/or their upstream providers) have taken to trying to further filter illegitimate DNS traffic.

However, this new filtering has resulted in some legitimate DNS traffic being filtered too. I've personally had to route all DNS traffic over a VPN to get reliable name lookups. Before I did that, certain domains could no longer resolve.

 

[DuckKnuckle]

Vumatel FTTH through CW in Brackenfell is dead

 

[Sinbad]

Vumatel FTTH through CW in Brackenfell is dead

Vuma subscribers on other isps also reporting issues btw

 

[Syphonx]

So, my guess on what just happened:

Crystal Web (and/or their upstream providers) are trying to mitigate the attack by filtering UDP traffic. However, UDP is central to DNS, and thus some UDP traffic at least needs to be allowed.

It seems like that the person doing the DDoS attacks found a way to to use UDP packets that look like DNS requests to get their attack through the filtering, and in response Crystal Web (again, and/or their upstream providers) have taken to trying to further filter illegitimate DNS traffic.

However, this new filtering has resulted in some legitimate DNS traffic being filtered too. I've personally had to route all DNS traffic over a VPN to get reliable name lookups. Before I did that, certain domains could no longer resolve.

Thanks, PIA VPN working fine, just have to set it to use TCP, UDP mode fails to connect.

 

[SilverCode]

So, my guess on what just happened:

Crystal Web (and/or their upstream providers) are trying to mitigate the attack by filtering UDP traffic. However, UDP is central to DNS, and thus some UDP traffic at least needs to be allowed.

It seems like that the person doing the DDoS attacks found a way to to use UDP packets that look like DNS requests to get their attack through the filtering, and in response Crystal Web (again, and/or their upstream providers) have taken to trying to further filter illegitimate DNS traffic.

However, this new filtering has resulted in some legitimate DNS traffic being filtered too. I've personally had to route all DNS traffic over a VPN to get reliable name lookups. Before I did that, certain domains could no longer resolve.

My guess is it would be a DNS Amplification attack (link 1, link 2)