About 25 hours ago, I got an e-mail from UptimeRobot (uptimerobot.com) telling me that me websites had gone down.
I raced over to my server room, where my TP-Link router was completely unresponsive (even from the LAN side), traffic lights on the router where blinking at an ungodly speed, etc. I got a message from a "friend" saying that somebody he knew was an idiot and had gone on some chat channel and told everybody to attack me.
After 17 hours of getting hammered with traffic (around 15,000 packets per second), I moved my network to a new WAN IP, which obviously stopped the attack. To the best of my knowledge, those unpleasant people are still attacking the old IP. I feel bad for whoever that address gets allocated to.
Anyways, after I switched IPs, the traffic lights were still blinking on my router, and it was still unresponsive. I gave it and the modem both a hard reboot; and after they came back up the traffic lights had slowed to a normal speed and the router is now responsive.
The problem is, the network still feels like it's under attack - whenever I ping google.com, (which is obviously up), I get about 50% packet loss and the round trip takes around 100ms - compared to the normal 30ms or so.
I've rebooted the router and modem several times, thinking that maybe they were still 'clogged up' with traffic from the attack; but this has proved unsuccessful. The LAN itself is fine - I get 0% packet loss between different nodes with latencies as low as 0.051ms, so I've deduced that nothing within the internal network is causing the problem.
Does anybody have any idea as to what's going on here? Is it possible that the pipe to our ISP is completely backlogged with traffic sent during the attack? None of this makes sense to me, just wondering if anybody has experienced anything like this before. Thanks in advance.
Here is some output after pinging the network from the outside, in case anyone's interested:
(IP omitted because I'm paranoid now after that attack)
PING x.x.x.x (x.x.x.x): 56 data bytes 64 bytes from x.x.x.x: icmp_seq=0 ttl=59 time=47.797 ms 64 bytes from x.x.x.x: icmp_seq=1 ttl=59 time=47.103 ms 64 bytes from x.x.x.x: icmp_seq=2 ttl=59 time=41.792 ms 64 bytes from x.x.x.x: icmp_seq=3 ttl=59 time=51.739 ms Request timeout for icmp_seq 4 Request timeout for icmp_seq 5 Request timeout for icmp_seq 6 Request timeout for icmp_seq 7 64 bytes from x.x.x.x: icmp_seq=8 ttl=59 time=43.218 ms Request timeout for icmp_seq 9 64 bytes from x.x.x.x: icmp_seq=10 ttl=59 time=45.034 ms 64 bytes from x.x.x.x: icmp_seq=11 ttl=59 time=42.263 ms Request timeout for icmp_seq 12 64 bytes from x.x.x.x: icmp_seq=13 ttl=59 time=46.498 ms Request timeout for icmp_seq 14 Request timeout for icmp_seq 15 Request timeout for icmp_seq 16 64 bytes from x.x.x.x: icmp_seq=17 ttl=59 time=43.183 ms ^C --- x.x.x.x ping statistics --- 18 packets transmitted, 9 packets received, 50.0% packet loss round-trip min/avg/max/stddev = 41.792/45.403/51.739/3.031 ms
This is from a location that is geographically close to the network, and normally has 0% packet loss with latencies around 25ms. Thanks again in advance for your help.
Here is a traceroute, it's probably more informative than the ping output above:
traceroute to x.x.x.x (x.x.x.x), 64 hops max, 52 byte packets 1 10.0.0.1 (10.0.0.1) 4.767 ms 4.178 ms 4.195 ms 2 220.127.116.11 (18.104.22.168) 11.357 ms 18.649 ms 14.658 ms 3 22.214.171.124 (126.96.36.199) 15.616 ms 32.639 ms 16.381 ms 4 188.8.131.52 (184.108.40.206) 26.902 ms 13.912 ms 15.729 ms 5 220.127.116.11 (18.104.22.168) 26.328 ms 27.733 ms 15.328 ms 6 * * * 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * ^C
It looks like the packets are being dropped after
22.214.171.124, which according to ARIN's WHOIS is a Rogers switching station on Mt. Pleasant - which should be the last hop between where I am and the network I'm trying to reach. This leads me to believe that it's not my ISP's problem, so I don't think my pipe is the problem.