Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DoS attacks against my online game

hookrace.net

Post reply on HN
Print view View original

91–100 of 100 posts

Re: DoS attacks against my online game

#91

Post by leath »

python273 wrote: post #72

I don't know much about DDoS protection, but wouldn't it be possible to add token to UDP packets? So the client first connects to a TCP server and gets 4 bytes token unique per IP. Every UDP packed should start with that token. Since an attacker with spoofed IP can't get a valid token, their packets can be ignored with a cheap check. Might be even possible to use iptables/XDP for it?

We already have a token in the protocol and this is indeed a viable way to help drop invalid traffic. However, none of us are really experienced enough with the networking stack of the linux kernel (nor are these things very well documented) to craft a conntrack module or an XDP program to parse the header and keep track of the assigned tokens. Dropping these any later than the nftables stage is just not enough as we already do that.

We have a small team who work on this project during our free times and most of us just don’t currently have the time to dig into conntrack/nftables/xdp.

Re: DoS attacks against my online game

#92

Post by Arwill »

python273 wrote: post #72

I don't know much about DDoS protection, but wouldn't it be possible to add token to UDP packets? So the client first connects to a TCP server and gets 4 bytes token unique per IP. Every UDP packed should start with that token. Since an attacker with spoofed IP can't get a valid token, their packets can be ignored with a cheap check. Might be even possible to use iptables/XDP for it?

It is a standard practice to have a "login server" and a separate "game server". The login server generates the token, and notifies the game server to accept it. The login server handles a queue, and can throttle login attempts. The login server can handle load balancing for multiple game servers, redirecting logged in players to different game servers. Its possible to run multiple login servers too, and restrict the access to specific login servers geographically and to run them with different providers.

Re: DoS attacks against my online game

#93

Post by def- »

leath wrote: post #89
bencollier49 wrote: post #77

Is this game a really big thing in Germany? Seems like all the major teams are German.

A mention in a German gaming magazine very early on in the games lifetime brought a fair bit of attention

Historically Europe and South America were our main locations, but recently we have grown mostly in East Asia.

Re: DoS attacks against my online game

#94

Post by remram »

zeta0134 wrote: post #22
seiferteric wrote: post #21

Why is ddos still possible? It is possible for isp’s to stop this. There is a proposal for isp level blocking if spoofed source addresses. Also there should be something like an api where I can tell my isp that I don’t want to receive anymore packets from a given source and it should be propagated up the chain.

The key is in the first D: "distributed." A DDoS is designed to look just like legitimate traffic, but coming from many sources all at once. The goal of a successful attack is to both overwhelm the target network by sheer volume, and to make it difficult to stop the attacker without also blocking legitimate traffic. They persist in large part because they exploit the interconnectivity that makes the internet useful i…

The firewall can't tell what is legitimate traffic and what looks like legitimate traffic, but the application often can. This is what DOTS us trying to cover: let the application server tell the firewall who to allow or block in real time.

https://www.rfc-editor.org/rfc/rfc8782.html

Re: DoS attacks against my online game

#96

Post by narrator »

lotsofpulp wrote: post #79
nightfly wrote: post #56

Earlier quoted context omitted.

I think it can be cheaper to initiate these types of attacks than to defend against them. Just pissing someone off with an extra $20 to spend can give you a bad day

Offense in cheaper than defense even in non internet related situations, hence societies with high levels of trust between its members are able to advance more quickly due to not needing to waste so many resources on defense.

Low trust societies have their advantages. They are less likely to develop into dictatorships because factions don't trusts other factions enough to give them too much power.

Re: DoS attacks against my online game

#97

Post by def- »

eastdakota wrote: post #73
leath wrote: post #14

Earlier quoted context omitted.

As the blogpost mentions TCP is not exactly desirable for our project. Moreover, if you contact Cloudflare about those products you'll get a monthly quote that is far beyond what an open source project run by donations can sustain :)

That shouldn’t be the case. Email me if it is. I’ll make sure we help: matthewatcloudflaredotcom.

Thanks, reached out to you.

Re: DoS attacks against my online game

#98

Post by hutrdvnj »

longsword wrote: post #90

I'am a Developer of an larger custom modded GTA Server (Roleplay Server), with 500-700 online users in peak hours. The community is very toxic. In the beginning, we received several DDoS Attacks daily, so we decided to build our own protection. We are working with IPtables and IPSets, as you are. But we dont bother ispecting the contents of a packet: Our users are logging in to the Server over HTTPS to a dedicated Se…

> because an attacker clogs our 10GB line

Yeah that's the problem, attackers get 10+ gigabits UDP flood quiet easily these days and with that they simply hammer down your line, well before any of your software protection mechanism could react.

Re: DoS attacks against my online game

#99

Post by python273 »

leath wrote: post #91
python273 wrote: post #72

I don't know much about DDoS protection, but wouldn't it be possible to add token to UDP packets? So the client first connects to a TCP server and gets 4 bytes token unique per IP. Every UDP packed should start with that token. Since an attacker with spoofed IP can't get a valid token, their packets can be ignored with a cheap check. Might be even possible to use iptables/XDP for it?

We already have a token in the protocol and this is indeed a viable way to help drop invalid traffic. However, none of us are really experienced enough with the networking stack of the linux kernel (nor are these things very well documented) to craft a conntrack module or an XDP program to parse the header and keep track of the assigned tokens. Dropping these any later than the nftables stage is just not enough as we…

I found this tutorial [0] and example [1] how to read/update BPF hashtable data from python bcc module. If UDP packet structure is not too complex, it might be not too hard to implement I guess.

[0] https://duo.com/labs/tech-notes/writing-an-xdp-network-filte...

[1] https://lwn.net/Articles/747640/

Re: DoS attacks against my online game

#100

Post by greenreaper »

seiferteric wrote: post #49
leath wrote: post #48

Earlier quoted context omitted.

100% agree with you. We gave the ISPs more than enough time to get this under control, yet they don't seem to want to bear any cost in preventing what are essentially crimes (though as shown in the blog post cybercrimes are seen as a bit of a joke unless they cause monetary damages) taking place on their networks. If they are not willing to self-regulate it's the governments job to regulate them.

It's also telling that ISP's are fine with charging you per GB data you consume but apparently don't care about multi 10's GBS+ attacks that presumable consume tremendous amounts of bandwidth? I guess it says something about the true cost of data...

It is likely that they have plenty of spare outbound capacity, especially given how most home connections are asymmetric with respect to upstream.

As for their charging, that is called "value pricing" - what matters is the value to you, not the cost to them.

Post reply on HN