DDoS causing Server to Crash, Asking for Mod

[Lynne]

Originally Posted by space?

Sorry, I don't understand this one. If every visitors IP is listed and blocked in the iptables - who can use the board anymore?

I said it only grabs the IPs of those pounding the board (or tracker). Most regular users do not pound the board.

[space?]

And how to you get the IP of the users which are pounding the board?
Every mechanism which would be able to split the IPs into "good" and "bad" ones, would be another possible target, I think.

[Sycosphere]

Space, do you visit vb.org a 100 times/minute ?? or u have more than a 1000 hit/day on it?? they use this kind of information to separate humans from bots.

[space?]

Yeah, knowing that.
But I think this seperation could be a vuln too.

I didn't wanted to make you trouble, if it works and helps - fine.

[Lynne]

Our script did cause some problems. We have a tracker on our board also, so there are times when a single IP will hit the tracker and if it's too busy at that moment, it sends the request again (and sometimes again and again, it depends on the bittorrent client) and so a few legitimate users did get caught in our IP tables. I did have a notice on the top of the board telling users that if they were blocked, to send me an email with their IP. I also flushed the iptables a couple of times a day.