A call to (nerdy) arms

[Pringles]

Originally Posted by rickjames [You must be logged in to view images. Log in or Register.]

=
Now one potential theory I had (im a receptionist at an IT firm too) is that they may be abusing socket connections to the webserver (spam HTTP requests) as it seems the website goes down (colocated/same box/same VM) with the game server. If someone would be able to confirm or refute this, i would be willing to pony up a little cash to help get the website/forums hosted on a separate instance to mitigate that vulnerability.

Except that would stand out like a sore thumb as the cause and Rogean would have already resolved it.

[trukk]

No clue what is really going on here but if I had to guess, I'd say just plain UDP flooding.

UDP is connectionless, meaning it's one way from the sender to the P99 server. This allows the source IP to be spoofed, thus a single host can pretend to be sending from a few thousand different IP's making blocking very hard.

Most good ISP's will have spoof protection turned on, but it only takes a handful of zombied hosts that don't have the protection on to overwhelm the server.

I would assume that the EQ client uses some UDP connections back to the server, which the port they are spoofing on. You can;t block that port, because it is how the legit clients work.

This is all just a wild guess, but probably pretty close.

-Chris

[Blink]

It's the internet and everyone's an expert!