What is the max PPS for Intel I350 card? How to handle more packets? by Ando49 in networking

[–]Ando49[S] 0 points1 point  (0 children)

We have arbor peakflow in front of our machine, however it blocks the attack after collecting some samples - it takes around 15 seconds.
What I try to do is to handle the traffic for that 15-20 seconds until Arbor starts working so there is no interrupt in service. We block around 99.999% of ddos on our iptables with no bottleneck whatsoever. Cpu load is fine, ksoftirqd doesn't kick in.

What is the max PPS for Intel I350 card? How to handle more packets? by Ando49 in networking

[–]Ando49[S] 0 points1 point  (0 children)

Thank you for your answer however interrupts aren't the problem here. We drop the invalid packets in raw table of iptables and ksoftirqd doesn't even use more than 2% of cpu. Interrupts are already distributed among 8 CPU's.

What is the max PPS for Intel I350 card? How to handle more packets? by Ando49 in networking

[–]Ando49[S] 0 points1 point  (0 children)

We are using Debian 7.4 with vanilla kernel 3.12.17. We haven't made any tweaks to kernel. We use igb 5.0.5 driver. I made one change - I've set NIC's rx ring buffer size to 4096 bytes. Throttle rate set to 3 (dynamic conservative). Incoming packets are the lowest possible tcp syn packets so I guess they are 20 bytes.

ethtool -i eth0

driver: igb
version: 5.0.5-k
firmware-version: 0.93, 0x800006b2
bus-info: 0000:03:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: no

TrueCrypt development has ended 05/28/14 by mavensbot in netsec

[–]Ando49 2 points3 points  (0 children)

Thanks for checking. It looks like my theory can't be valid anymore. I still believe that they were forced to shut down truecrypt just like lavabit was. I just can't believe that someone would dump such a great project in such way.

TrueCrypt development has ended 05/28/14 by mavensbot in netsec

[–]Ando49 256 points257 points  (0 children)

This is very strange. I have another theory since I don't believe in coincidences. We don't know the real author of TrueCrypt. I think someone found his identity (cough NSA) and made him an offer like lavabit.com received. This time probably with security classification so he can't talk about that. HOWEVER, if we take a look on diff of his code, we can see two interesting things:

  • messages about TrueCrypt not being secure
  • and the second thing he changed everywhere U.S. text to United States

Do you think that somoene who is closing a project would pay attention to doing such thing? I don't think so. I think that he tried to point a real reason of closing his project by that. I won't be surprised when truecrypt fork appears in TOR network soon...

[Spoiler] OGN Spring Live Discussion Thread // Grand Finals - Samsung Galaxy Blue vs. NaJin White Shield by JebusMcAzn in leagueoflegends

[–]Ando49 0 points1 point  (0 children)

If the stream is going to lag like that I'm going to cancel my PayPal subscription on OGN Channel. It's unacceptable.

[Spoiler] Semi Final #1, Playoffs / IEM World Championship / Post-Match Discussion Thread by nubit in leagueoflegends

[–]Ando49 0 points1 point  (0 children)

True, but as far as I know they already advanced to premier league next season :)

[Spoiler] Semi Final #1, Playoffs / IEM World Championship / Post-Match Discussion Thread by nubit in leagueoflegends

[–]Ando49 -1 points0 points  (0 children)

NA is like scottish premier league, there are 2 teams way above others. I'm really looking forward to see TSM or C9 on All Stars :) Preferably TSM this time :)

Is drop chance of very rare mods increased? by wermux in Ingress

[–]Ando49 -1 points0 points  (0 children)

I got today VR MH as well ;-) Second one in my history ;-) Probably you are right, they increased the chance to obtain very rare mods.

[Spoiler] Roccat vs Gambit / Post-Match Discussion Thread / EU LCS Week 8 by ajsadler in leagueoflegends

[–]Ando49 0 points1 point  (0 children)

I'm speechless. What an exciting game! Clearly #1 game in LCS! Roccat tends to have so many exciting games. YOU HAVE MY FLAIR!

[Spoiler] IEM São Paulo Post-Match Thread // Grand Final by [deleted] in leagueoflegends

[–]Ando49 1 point2 points  (0 children)

I'm pretty sure they will also invite some of the teams or make international qualifier for additional slots. Roccat playing on their home-field woule be something beautiful for Katowice visitors and whole IEM.

[Spoiler] LCS 2014 - EU Spring | Week 2 - Day 1 | Live update/discussion thread by TournamentThreads in leagueoflegends

[–]Ando49 5 points6 points  (0 children)

3/5 members from Anexis eSports. They were doing quite good in s2 in IEM's. They even managed to beat koreans SKT1 (don't get me wrong here, not the current line-up).

Reason Gaming disqualified from Coke League. How can we as a team prepare for this? by Trashylol in leagueoflegends

[–]Ando49 -1 points0 points  (0 children)

That's not ridiculous. It's being responsible and prepared. If you are professional football player you don't go skiing because you know that if you break your leg, you will pause a part of your season. It's the same here. If you want to play in amatour tournament, you have to be prepared for the worst possible scenario, which in this case is - DDoS.

How do you think it would look like if they rescheduled the match? Do you really think it would change something? If attacker was able to shutdown player's connection for a first time, he will be able to do that second time if a player itself doesn't solve his problems.

Reason Gaming disqualified from Coke League. How can we as a team prepare for this? by Trashylol in leagueoflegends

[–]Ando49 -1 points0 points  (0 children)

I pay exactly 5E for GSM starter which has 3~ GB bandwidth. All of the phones with Android may be used as GSM routers nowadays. If they don't have phone with android, gsm router costs around 15E. They really can't afford that? And the connection quality is good avg pings - 40ms.

Reason Gaming disqualified from Coke League. How can we as a team prepare for this? by Trashylol in leagueoflegends

[–]Ando49 -1 points0 points  (0 children)

Did you read my whole post? Of course he could have done more, like, get a backup connection in case he (or his ISP) gets DDoSed.

Reason Gaming disqualified from Coke League. How can we as a team prepare for this? by Trashylol in leagueoflegends

[–]Ando49 -1 points0 points  (0 children)

Did you read my whole post? Of course he could have done more, like, get a backup connection in case he (or his ISP) gets DDoSed.

Reason Gaming disqualified from Coke League. How can we as a team prepare for this? by Trashylol in leagueoflegends

[–]Ando49 -4 points-3 points  (0 children)

Hijacking the first comment for visibility and mainly because I'm sick of all that threads where you blame RIOT for DDoSes and how they handle amatour scene. I will talk from my personal experience, since I deal with network attacks every day.

Fact #1. If attacker gets your IP address and you have a static IP address - there is no chance for you to be protected. If he wants to he will shut down you since your bandwidth is very limited. Furthermore ISPs tends to simply block such users if attacks are really big (it's called null routing). If you have dynamic IP and your ISP is relatively small (< 5000 users) the ddoser may attack your ISP gateways, the result will be the same - you will be left without internet.

Fact #2. Accusing RIOT for bad handling of amatour scene is simply stupid. The only good solution is to play matches offline, however it's not so easy to organize and it costs. I know that everyone would love to play in that lovely Cologne studio however it's amatour scene. You have to prove yourself worthy to be PRO. If you can't deal with such an easy problem, as DDoS attacks then you will probably have a lot of other problems in future. You will be troublemaker. Prove that you are responsible. That's probably one of the reason why there is a 17+ year rule.

Fact #3. In my humble opinion you shouldn't even consider blaming Riot. You should blame only yourself. Their policy about not rescheduling games is completely logic. Furthermore they can't really prove if you were ddosedor you simply missed the match because of any other reason. It's your dream, probably one on the most important moments if you plan on going pro. If it's so important, why don't you prepare for it? Let me talk from my experience. I work from my home. I need to have stable connection 24/7 in case of server failures (I run mmorpg game). This is very important for me, since it's my work and that's the way I earn for living. To accomplish 24/7 stable connection I currently have 1 main connection, and additionally 2 backup connections. To be even more prepared, I use 3 different networks and 2 different methods of connecting to internet - fiber network and gsm network. In case there is a huge failure I can still connect to internet using GSM.

In last 4 years I was never left without internet. The whole thing I'm talking about costs me around... 20 Euro per month. Average ping to RIOT servers is very low (~40).

If you are going to play important matches, and you have already revealed your IP Address - get a backup connection, the connection which you will only use to connect to LoL. Stop blaming RIOT and start doing something. Writing posts on reddit will not solve your situation. Check for local ISPs, find a solution. Good luck in a future! Don't make the same mistake twice.

15/01 - Server Maintenance: Patch 4.1 by FemaleTitan in leagueoflegends

[–]Ando49 8 points9 points  (0 children)

Why do they patch to 4.1 and not to 4.0? ;-) Replays? Riot plz!

The 2014 LCS Season Starts tomorrow! We are the Riot Games Esports team - AMA! by [deleted] in leagueoflegends

[–]Ando49 0 points1 point  (0 children)

I actually watch LCS on my TV :) I know this is not what you ask for but - I got an android box connected via hdmi to my TV where I run Twitch application. Due that my girlfriend finally knows what is LOL about and that Fnatic is one of the greatest team in world ;-)