Post
Topic
Board Pools
Re: [6600Th] Eligius: 0% Fee BTC, 105% PPS NMC, No registration, CPPSRB (New Thread)
by
bolverk
on 03/04/2014, 23:02:33 UTC
A semi-well known fact about me:  my real life job includes DDoS mitigation at the ISP level for multiple ISPs.

This particular attack against Eligius has taken almost every form possible... UDP reflection attacks (DNS, NTP, SNMP, etc... 30+ gigabit at times), TCP SYN attacks (over 20 gigabit peaks), botnets directly flooding pool ports (multiple gigabit), botnets attempting application layer (stratum and HTTP) attacks (varies up to several gigabit and > 100k connections), HTTP request floods from botnets and other amplification (wordpress being one), hanging TCP connection attacks, various attack attempts against public facing bitcoinds, flood attacks against upstream routers, social engineering attempts (someone has contacted the abuse@ addresses for some nodes claiming Eligius is DoS attacking them, lol, presumably in an attempt to stir trouble with our hosts), and probably a ton of other things that are just automatically filtered/ignored.

It's nice to get some hard info on what's going on.  I, BTW, work for a backbone provider, specifically for managed IP services.

I am surprised that Eligius is operating with that level of network connectivity, as a mostly unfunded operation I has thought your resources were a lot more meager.  That said, at the point your pipe is getting filled your provider should be willing to either provide some sort of CoS shaping and/or basic filtering for you, to keep pipe congestion down.  For what gets past that I would assume you've got some basic stateful firewalling in place, at least.

Some of your other attacks, like the HTTP requests, while intended as a DDoS, are great at pointing out scalability problems, for which there's probably some low hanging fruit.  Some squid boxes, ICAP, memcached, etc.  I haven't looked at the stratum protocol so I couldn't guess what your problems would be there.

Sounds like you guys are definitely getting a trial by fire.