Slashdot Mirror
DoS Attack Forces EVE Online Offline
Resorting to the out-of-band messaging that is Facebook, CCP Games has announced that "At 02:05 GMT June 2nd, CCP became aware of a significant and sustained distributed denial-of-service attack (DDoS) against the Tranquility cluster (which houses EVE Online and DUST 514) and web servers."
I was just wondering why I couldn't log in! I criticize you guys a lot, gotta give you props this time.
I swear to God...I swear to God! That is NOT how you treat your human!
That is all.
They need to get this sorted ASAP. I have important Internet spaceship business to tend to and it really can't wait any longer.
What kind of intricate in-game machinations will this turn out to be connected to?
Why would anyone launch a DoS attack on EVE online servers?!" :P
Nerds should not attack other nerds.
Why do the gaming servers respond to requests from non-players?
I assume that there is, at very least, some sort of authentication service that has to evaluate a request to determine whether or not it comes from a player...
*sigh*
You need to log in to the game at some point.
But only once, unless you are the sort of coward who logs out!
It's not Facebook that they're updating from; It's Twitter. Their Facebook account is linked to Twitter.
Anyway, this isn't the first time the servers have been DDoS'd; This happens about every 4 months or so on average. And unfortunately, they've handled it about as well each time as you're seeing now: They tend not to announce the DDoS until hours after the news is all over the forums that people are experiencing mass disconnects and instability. And once the problem has been identified (late), their response is usually to kill all the servers, remove the BGP routing table entry for their network, and wait it out.
They don't have the capability of weathering DDoS attacks; Though they claim otherwise, history tells another story. It has to do with the fact that their game depends on a cluster architecture that is not adaptable to something like Amazon cloud, or any kind of scalability. I don't really want to get into details here because it gets really technical, but basically it comes down to data syncronization within the cluster requiring very low latency between nodes. And that means you can't locate the nodes off-site, and proxying is only of limited utility.
They tried proxying the front-end for accepting connections and authenticating users, because that's what has been targetted in the past and is one of the few components that can be moved. The current DDoS attack though is generating large numbers of connections that look the same as legitimate connections, so the proxies are allowing them. Rather than just throwing as much bandwidth as they can at the network as in the past, they're now crafting their traffic.
I suspect the reason the attack is being launched now is because in a few days they're releasing a new patch of the game which will change the network protocols used by the client... their hack might not work then, so they probably decided to launch it now before it becomes useless. They are hitting people on the weekend because it's when the most users are on... so it's most likely to be noticed.
#fuckbeta #iamslashdot #dicemustdie
You should be in charge of the whole internet. You got it all figured out.
Invaders must die
Will rejoice
All the countless Wives, Girlfriends, significant others, etc. ... wait ... I think I know who might be behind this. ...
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
aka Spreadsheet Simulator 2013?
unless you are the sort of coward who logs out!
Pfft, I'm the sort of coward who doesn't even log in!
You should probably learn how networking actually works. It will avoid making posts that are this bad.
The way the server knows what IP the packet came from is by the IP layer of the stack processing the packet. Which means the packet triggered work by the server, and the DDoS can do it's job.
Your "solution" requires the server to predict that a non-player IP will be sending a packet and reject it before examining the packet at all. But that's assuming the DDoS is sending random packets.
If the person behind the DDoS doesn't have enough nodes to carry out the attack above, then they can send bad "login" requests. The server will have to process them completely in order to reject the login.
Wives? Girlfriends? Obviously, you've never met anyone who plays EVE Online.
Couldn't have happened to a more wretched hive of scum and villainy in all the virtual worlds!
(obviously, that comment excludes carebears & all non-sociopath gamers :)