EVE General Discussion

Install a good third party firewall that shows and allows control of incoming and outgoing connections, outbound filtering is what you need to have control over.

Mac: I use 'Little Snitch'
Windows ? maybe a windows user can suggest a good one...

Outbound filtering FTW

there is no way to be 100% sure you are not, but a few basic things can make it higly unlikely.

1- SPI firewalls on network head (modem / modem-router) most modern router come with this
2- firewalls on each computer on your local network, any windows OS does have one
3- an up-to-date operating system, with user access control preferably (requires visa or higher)
4- an antivirus software, with real time scanning and comportemental detection, with the latest update ( database and soft, should be done at least once/ day, and a daily quick scan ) this doesn't take more than 5 minutes usually (most antivirus, even free ones, pack those features)

if you also are carefull about the websites you visits and the mail you receive (especially the atached content), there is very little risk.

now, there is still the possibility of a worm using 0-days but tbh, not much one can easily do in that regard.

if you are in doubt, it could also be a good idea to run a scan from an external OS (CD-rom / usb boot device) to ensure from an external POV the system is clean, this can help getting rid / ensuring there are no threats that would have disabled your antivirus

Just logged in, everything seemed to be normal, but then all of a sudden "socket closed" message. I have a feeling that it is not over yet.....

I use the Comodo toolset on Windows and I like it a lot. It has Firewall, Virusscan, Sandbox mode and other stuff for free. Also no annoying advertisement yet.

It shows in and outbound traffic in a very easy to understand way. However, with any third party firewall, you may run into issues when hosting/joining peer-to-peer games. Sometimes you may have to disable the firewall or put it into gaming mode.

What year is it?

ICMP Echo (i.e. ping) floods are quite uncommon and rare these days.

Most DDoS attacks comprise of SYN Floods.

The latest and greatest in DDoS is that the script kiddies (i.e. noobs) have finally realised the potential for "amplification attacks" using NTP or DNS. The DNS Amplification attack is quite old, but since there are a lot of open resolvers on the Internet it still works. These typically range from a few Gbps up to 100-200Gbps.

The NTP Reflection/Amplification attack is considered "new" as it has been in the news recently, hitting targets with 400Gbps. (CloudFlare)

It should be noted that after the Open NTP Server Project went live, around 80% of open NTP servers are now not usable in this kind of amplification DDoS attack.


Tailoring a DoS attack against a specific type of service, is also common (but not as common as SYN floods). See "slowloris denial of service". (Slowloris most likely not the problem in this case.)

Last but not least, NTP and DNS Amplification attacks are hard to track/"triangulate", because the attacker sends a small spoofed packet where the source IP points to the target. It is known that some of these people performing DoS are quite often juveniles. The largest provider of DoS services are generally Russian. (Sorry, but that's generally the image in the community. That doesn't mean they choose the targets though.)


Anyway, I hope CCP finds a viable solution as DDoS'ing an online game is just plain annoying and stupid. Keep in mind some DDoS attacks are meant to cover other types of attacks, and I hope CCP will check their payment system for any suspicious activity as I'd rather not have any of my details disclosed despite that I don't use my credit card with EVE.

Hahaha one single firewall will break down if it only has 100Mbps available and a DDoS attack is 110Mbps'ish. You need something far more powerful than a "good firewall".

FYI filtering outbound SYN/ACK packets during a DDoS will still overwhelm the server. Plus you could easily lock out legitimate clients.

Let's just not hope the root cause was this: http://bits.blogs.nytimes.com/2012/09/10/member-of-anonymous-takes-credit-for-godaddy-attack/

Tinfoil On..

What if..

Chribba added bot software to all his sites..

Eveboard..

Dotlan..

and Omg

EFT..

and Pyfa..

WE ARE DDOS OURSELVES

AHHHHHHH

Guldarn Rumaniens jess won't stop invading the UK!

Dotlan is not from Chribba but Wollari.
EFT and Pyfa are also not related to Chribba.

I'd like to point out to the DEVS that stating all ships lost during a DDoS attack might be a bad move.

What if the loosing side in B-R decided to DDoS the server as "all ships lost during server issues are reimbursed"