The Firing Line Forums

Go Back   The Firing Line Forums > Forum Support > Site Questions and Tech Support (NO FIREARMS QUESTIONS)

Closed Thread
 
Thread Tools Search this Thread
Old May 15, 2007, 05:21 PM   #1
Derek Zeanah
Senior Member
 
Join Date: March 30, 2000
Location: South GA
Posts: 267
THR is down right now

damn - I'm posting most of the tech support threads here.

THR is currently down. We were suffering from a DOS attack that was (mostly) due to a compromised server in Chicago. We were seeing inbound traffic of ~50 Mbits/second at the firewall (normal is about 0.768 Mbits) which was enough to swamp the machine. Rebooting the firewall got us back in, and I reconfigured the firewall a bit so it wouldn't run out of memory (my guess as to what caused the actual outage).

We were still seeing the traffic, and rather than pay for it I had my network provider intervene. THR has been 'null-routed' until the attacks stop, which pretty much means "you can't get there from here." The company that owns the compromised host has a disconnected abuse telephone line, and their web server is reporting errors, so they'll be tough to reach.

Once the attack dies, THR will come back to life.

(As an aside, I'm paying for a 10 Mbit link, but I apparently have significantly better than that.)
__________________
-- Derek

"An elective despotism was not the government we fought for."
--Thomas Jefferson
Derek Zeanah is offline  
Old May 15, 2007, 05:45 PM   #2
ArfinGreebly
Member
 
Join Date: November 3, 2006
Location: North Idaho
Posts: 48
Targetted?

Derek,

Any idea if this sort of thing is just "random" as a consequence of somebody leaving the gate open, or is this a more targetted kind of attack?

And if "targetted" is the verdict, what then?
__________________
"Truth is a dangerous thing: once found, you must never turn your back on it." -- [email protected]

"Look at it this way. If America frightens you, feel free to live somewhere else. There are plenty of other countries that don't suffer from excessive liberty. America is where the Liberty is. Liberty is not certified safe." -- [email protected]

Last edited by ArfinGreebly; May 15, 2007 at 06:24 PM.
ArfinGreebly is offline  
Old May 15, 2007, 06:05 PM   #3
Derek Zeanah
Senior Member
 
Join Date: March 30, 2000
Location: South GA
Posts: 267
Quote:
Any idea of this sort of thing is just "random" as a consequence of somebody leaving the gate open, or is this a more targetted kind of attack?
Well, apparently THR's IP address was the recipient of all the attention.

I'm not clear on whether it's just the one compromised server in Chicago that's banging on the doors, or whether other machines are involved as well. I just know there's still a flood of packets trying to swim their way to THR's IP address.
__________________
-- Derek

"An elective despotism was not the government we fought for."
--Thomas Jefferson
Derek Zeanah is offline  
Old May 15, 2007, 07:15 PM   #4
Surefire_U2
Senior Member
 
Join Date: November 26, 2004
Posts: 197
Could user computers be attacked when attempting to go to the THR site?

(I'm not a techie, so if this sounds like a dumb question please be patient)
Surefire_U2 is offline  
Old May 15, 2007, 07:48 PM   #5
SteelyNirvana
Member
 
Join Date: December 30, 2006
Posts: 43
I'm glad to know that its down and my internet explorer is'nt on the fritz. I was about to download a copy of netscape to see if I could get on. Hurry back THR
SteelyNirvana is offline  
Old May 15, 2007, 07:57 PM   #6
txgho1911
Member
 
Join Date: September 26, 2005
Posts: 45
How about a backdoor address for the longtime members to bypass this rockstar tantrum?
__________________
socialnewswatchDOTcom instead of Drudge
txgho1911 is offline  
Old May 15, 2007, 08:02 PM   #7
RNB65
Senior Member
 
Join Date: October 17, 2006
Location: Richmond, VA
Posts: 167
Derek, if the attack is coming from one machine, can't you just ask your ISP to block inbound packets from that IP address? It's tough to stop a DDOS, but a DOS coming from a handful of hosts should be pretty each to squelch.
RNB65 is offline  
Old May 15, 2007, 08:27 PM   #8
foob
Member
 
Join Date: July 22, 2006
Posts: 99
Why can't your ISP block the traffic from the compromised server only? How many could there be? At most a handful could have be compromised, probably all from the same company with the same subnet with the same servers with the same vulnerabilities.
foob is offline  
Old May 15, 2007, 08:38 PM   #9
Derek Zeanah
Senior Member
 
Join Date: March 30, 2000
Location: South GA
Posts: 267
Quote:
Could user computers be attacked when attempting to go to the THR site?

(I'm not a techie, so if this sounds like a dumb question please be patient)
Nope.

Quote:
Derek, if the attack is coming from one machine, can't you just ask your ISP to block inbound packets from that IP address? It's tough to stop a DDOS, but a DOS coming from a handful of hosts should be pretty each to squelch.
If it's a handful, you're right.

Sorry I don't have more details. Once we confirmed the problem my ISP took care of the rest. I don't have the kind of diagnostic tools on the server to be able to determine which hosts (or how many) are involved.

Well, I didn't, anyway. Should be able to get solid info pretty quickly in the future, though.
__________________
-- Derek

"An elective despotism was not the government we fought for."
--Thomas Jefferson
Derek Zeanah is offline  
Old May 15, 2007, 09:28 PM   #10
P95Carry
Senior Member
 
Join Date: May 18, 2004
Location: South PA, and a bit West of center!
Posts: 300
Thx for heads up Derek ........ hope things resolve eventually.
__________________
Chris - P95 (P97 also!)
Guns don't kill people - people kill people.
NRA Certified Instructor & NRA Life Member.
Rohrbaugh interest/ownership? - Rohrbaugh Forum Rohrbaugh R9 FAQ Site
P95Carry is offline  
Old May 15, 2007, 09:35 PM   #11
fistful
Junior Member
 
Join Date: May 15, 2007
Posts: 5
Bad things happen when APS is down. For example, fistful gets really bored, and finally registers on TFL. And there goes the neighborhood.

By the way, can you all clue a brother about the identity of "mad lemur"? Unless it's the guy I'm thinking of.
fistful is offline  
Old May 15, 2007, 09:48 PM   #12
Sindawe
Member
 
Join Date: November 5, 2002
Location: Just outside of the PRoB
Posts: 56
OH NO!!! Who let fistful in here? We're doomed!

Thanks for the update Derek, I was wondering what was up when I could not get in during my lunch break. Creatures who launch DOS/DDOS attacks deserve to be pecked to death by cats.
__________________
When you dream, there are no rules.
People can fly, anything can happen...
Sindawe is offline  
Old May 15, 2007, 09:52 PM   #13
Kaylee
Senior Member
 
Join Date: June 14, 2000
Location: The Last Homely House
Posts: 1,677
Thanks Derek.
Kaylee is offline  
Old May 15, 2007, 10:01 PM   #14
Black Majik
Member
 
Join Date: May 21, 2004
Posts: 76
Thanks for the update Derek.

I guess I can take refuge here for a while...
__________________
~Richard
Black Majik is offline  
Old May 15, 2007, 10:02 PM   #15
Oleg Volk
Staff Alumnus
 
Join Date: December 6, 1999
Location: Nashville, TN
Posts: 7,022
The retarded lemur is who you think it is. I have no way of knowing if he's behind it, but I seriously doubt it.
__________________
Oleg "peacemonger" Volk
blog.olevolk.net
Oleg Volk is offline  
Old May 15, 2007, 10:21 PM   #16
fistful
Junior Member
 
Join Date: May 15, 2007
Posts: 5
Thanks, Oleg.

Sindawe, thanks for making me feel at home. Should I go ahead and change my screen name to Scapegoat already?
fistful is offline  
Old May 15, 2007, 10:53 PM   #17
helpless
Member
 
Join Date: March 8, 2007
Location: Gunshine State.
Posts: 15
I never post here, mostly troll...

But all day I could not get on THR and I remembered TFL mentioned a lot over there so I headed over to see if there was any info.

Thanks for the report guys, gotta love the internet.

I will be posting here more often now.

-Helpless
helpless is offline  
Old May 15, 2007, 11:11 PM   #18
s32
Junior Member
 
Join Date: February 14, 2007
Posts: 4
Arfcom??

I'm also having trouble getting onto AR15.com.
Whats going on
s32 is offline  
Old May 15, 2007, 11:19 PM   #19
Mortech
Senior Member
 
Join Date: December 30, 2000
Location: Shelton WA
Posts: 120
I don't feel so bad about being on here , I was registered here years before i registered at THR and now i have way more post over there .
__________________
S&W Model 10 38SPec , 19-3
S&W 39-2 , 59
S&W 1006 , 1066 , 3913
S&W M&P40
Mortech is offline  
Old May 15, 2007, 11:21 PM   #20
s32
Junior Member
 
Join Date: February 14, 2007
Posts: 4
TFL is great

I'm just worried.
Why are so many gun forums messed up at the same time?
s32 is offline  
Old May 15, 2007, 11:43 PM   #21
Jorg
Junior Member
 
Join Date: August 11, 2006
Posts: 3
Quote:
Why are so many gun forums messed up at the same time?
Here's a little song I wrote, you might want to sing it note for note. Don't worry, be happy. In every life we have some trouble. But when you worry you make it double. Don't worry, be happy. Don't worry, be happy now.

Hang in there, Derek. These things are a huge pain.
Jorg is offline  
Old May 15, 2007, 11:43 PM   #22
ArfinGreebly
Member
 
Join Date: November 3, 2006
Location: North Idaho
Posts: 48
Back Channel

Oleg/Derek,

PM sent regarding back channel capability.
__________________
"Truth is a dangerous thing: once found, you must never turn your back on it." -- [email protected]

"Look at it this way. If America frightens you, feel free to live somewhere else. There are plenty of other countries that don't suffer from excessive liberty. America is where the Liberty is. Liberty is not certified safe." -- [email protected]
ArfinGreebly is offline  
Old May 16, 2007, 07:50 AM   #23
flatdog
Junior Member
 
Join Date: May 19, 2004
Location: Louisiana
Posts: 0
I was editing my last post on THR at approx. 1600 hrs (CST). yesterday. Well before last nights Republican debate when the site went down for me. Don't know if that helps or not.

The thought of a world with no High Road is "More than I can bear."

There ain't no fleas on TFL either

flatdog
__________________
" Perfectly matched violence never solved anything."
flatdog is offline  
Old May 16, 2007, 07:54 AM   #24
lee n. field
Senior Member
 
Join Date: October 12, 2002
Location: The same state as Mordor.
Posts: 5,190
Thank you for the update.

I've been using THR to keep on top of the Illinois SB1007 situation (the regular capacity magazine ban the usual suspects are trying to weasel through as we speak).
lee n. field is offline  
Old May 16, 2007, 07:58 AM   #25
BenW
Senior Member
 
Join Date: December 15, 2001
Location: CA
Posts: 282
Quote:
Should I go ahead and change my screen name to Scapegoat already?
You might as well, since this is undoubtedly all your fault...
BenW is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 04:06 PM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2019, vBulletin Solutions, Inc.
This site and contents, including all posts, Copyright © 1998-2018 S.W.A.T. Magazine
Copyright Complaints: Please direct DMCA Takedown Notices to the registered agent: thefiringline.com
Contact Us
Page generated in 0.11098 seconds with 8 queries