This is what a DDoS attack looks like

http://www.geek.com/apps/this-is-what-a-ddos-attack-looks-like-1552975/

by etix • 13 years ago

180 70 13 years ago

geek.com

eterps• 13 years ago

https://code.google.com/p/logstalgia/

BaconJuice• 13 years ago

Thank you.

11031a• 13 years ago

awesome find. thanks

rozap2• 13 years ago

This has pretty limited use, but holy shit is it awesome. Thanks!

onemorepassword2• 13 years ago

Limited use?

As someone who over the past decade regularly had to sell higher management on investing in infrastructure, I can tell you this will be extremely useful.

Seriously, even if it's just a random visualization of some normal peek traffic, it will go down easier than dozens of actual arguments, slideshows with bullet points or fat reports nobody reads. Show the video, do a bit of handwaving and there's your budget...

For any techie trying to convince their boss they need more servers, this is a very powerful tool. Use with caution.

est• 13 years ago

Damn that's impressive. Someone please port a realtime WebGL version!

scoot• 13 years ago

If you like logstalgia, you'll love gource[1] which visualises source control change history. It's also available as a brew recipe on the Mac for easy-peasy install.

[1] https://code.google.com/p/gource/

Kekeli• 13 years ago

Love this

clone1018• 13 years ago

I actually have Logstalgia running with my primary server for Minotar, and at 4,000 requests per second this is normally what it looks like. Awesome program!

xfs• 13 years ago

How does DDoS mitigation look like? Do they use realtime dashboard with similar visualization to cut off hotspots?

WestCoastJustin• 13 years ago

In my experience it is fairly manual. Here it is at a very high level. First you want to determine if this is really a DDoS or legitimate traffic.

You might be notified via downtime, alerts of load, in this instance, I suspect; download graphs, log analytic (if using a cdn which can handle the load, then you might not notice for a while i.e. eye popping bill).

Narrowing down the attack profile means looking at logs. Be that network flow data (very helpful) or in this instance web server logs. Probably something like: totals grouped by ip, destination url, etc to see if there are any spikes.

Also, managing stress. If you are some type of retailer then you likely are losing money, people are asking for updates, etc. This can be extremely stressful.

etix2• 13 years ago

We use Munin for the graphs and Nagios for the alerts. The mitigation of the DDoS is done manually since we need to identify the patterns and block them.

Thaxll• 13 years ago

What kind of person would DDoS a video player website?

stackcollision• 13 years ago

The same kind of person who would steal books from a library, or talk in a movie theater.

buro9• 13 years ago

Maybe Videolan isn't the target and the DDoS is against someone else in the form of using Videolan's bandwidth against someone else?

That's my general assumption of any attack in which the response to a request is in the many MB range and the request is in the bytes range.

That someone with limited bandwidth and many connections is attempting to acquire a large amount of bandwidth to attack someone else.

skorgu• 13 years ago

HTTP is over tcp though so it should be Hard to convince vlc's servers to reply to a third party. Seems like a silly ddos actually but what do I know.

JoshTriplett• 13 years ago

Good thought, but source spoofing for an amplification attack wouldn't work here; from https://news.ycombinator.com/item?id=5613529 :

> The actual number of requests was not that high (400 req/s), but the botnet was downloading the whole vlc.exe, aka 22MB. So, we were at around 70Gbps during the night, in average.

Source spoofing would not allow downloading the whole file; the spoofed source address would get the first response packet and send an RST ("stop, no connection associated with this packet, go away") long before that point.

eterm• 13 years ago

Fantastic! I had read about such a log visualisation tool a long time ago (I'm not sure but I think I read it about it via NTK which should date it) but I had lost any knowledge of what it might be until now.

Now I can see such a tool and it looks wonderful.

(More on topic, DDOS is beautiful!)

negativity• 13 years ago

I'd be willing to go out on a limb and estimate that maybe some private interests in Hollywood, with certain four letter acronyms, despise open source media player projects like VLC, since they might represent a channel that can potentially enable bypasses that can circumvent precious, precious DRM.

The perception being: if you can see the source of a media player program, the encryption might be implicitly compromised. This is a silly idea though, because it neglects certain realities about the very nature of electronic encryption, and media consumption. Maybe having source code lowers the bar in some respects, but the reality is that determined people will simply bootleg media anyway, by other means.

Not an accusation though, just that my tinfoil hat is tingling. Who else might be so motivated to attack an awesome software project like VLC?

omni• 13 years ago

Cool / "good" projects get attacked all the time. I suspect this is because the attacker is guaranteed an audience on HN to marvel in the results of their work. I think this is probably simpler and more likely than the tinfoil hat theory.

pavel_lishin• 13 years ago

> Who else might be so motivated to attack an awesome software project like VLC?

Anyone who wants to show off a proof-of-concept attack to potential customers, without stepping on any huge toes. (e.g., it's relatively safe to DDoS VLC, not so much a U.S. government agency or a huge multi-national company.)

AUmrysh• 13 years ago

I could see it being some sort of message as CISPA was stalled in the Senate yesterday. More likely, however, is that we'll never know why.

GigabyteCoin• 13 years ago

I would suspect DDoS attacks to be akin to terrorist attacks in that somebody typically claims responsibility for them.

Tobu2• 13 years ago

Another option is some shady people bundling VLC with spyware, some of which have been successfully clamped down: http://blog.l0cal.com/2011/07/07/these-companies-that-mislea...

Or, less likely but more timely, the GPL→LGPL relicensing to get an AppStore port, or the consultation to get the French DRM police to play its role in enforcing a conflicting law about interoperability.

snowwrestler2• 13 years ago

Why DDOS Reddit? Why DDOS Wikipedia? Why DDOS the New York Public Library website??

Within the last year or two I've given up trying to find reasons for DDOS attacks. I think of them now like Internet traffic weather. They just happen at random times and you better be prepared.

jbk8• 13 years ago

Disclaimer: VideoLAN president and lead VLC developer here.

The attack started on our new mirroring system (powered by mirrorbrain) 2.5 days ago, during the night (after 2am, so we were sleeping).

We were woken up (OP and I) in the morning by many mirrors complaining of high bandwidth use. The actual number of requests was not that high (400 req/s), but the botnet was downloading the whole vlc.exe, aka 22MB. So, we were at around 70Gbps during the night, in average.

Afterwards, North America got up, and things got worse. We had up to 1660 req/s, so around 292 Gbps...

This is very weird for a DDoS, to be honest.

Our front machine that splits the down mirrors was taking most of the load, and we were able to find the patterns to drop the botnet connexions, in order to not kill too much our mirrors. I won't discuss too much of the patterns, as you can imagine, but as usual, I'll be happy to discuss it IRL or by mail.

Tweaking the front server was also important to reduce the number of open connexions, to not kill our server.

2.5 days after, the attack is still going on, with an average of 500req/s.

The video was done using logstalgia, using scripts of OP, on my machine (<troll>he was running eclipse, he couldn't do both at the same time :)</troll>).

subsystem• 13 years ago

"This is very weird for a DDoS, to be honest."

Maybe it was aimed at bandwidth costs?

jbk8• 13 years ago

Maybe. Seriously, no idea.

drivebyacct2• 13 years ago

That's precisely what I don't get in this case, especially. The source is out there, there are other people mirroring vlc. So if you're trying to censor it, you're going to fail pretty hard. In the absence of that, what can it be?

Of course! It must be the mplayer folks!!

vabmit• 13 years ago

I don't know what request throttling solutions are available for nginx. But, for apache there are modules and scripts/code that can rate limit traffic and requests from specific IPs. Depending on the size of the botnet attacking, rate limiting requests by IP or network may have been a way to mitigate the DDoS effects. Again, depending on the specifics, you should be able to use iptables (if you're running Linux) to limit requests per source IP or IP range. The type of actions you can take with iptables are really quite robust.

I've had to deploy request rate limiting solutions in the past because of well meaning federated search mash-ups that included content from servers that I run.

Filtering by useragent seems to be a temporary solution. I think that's especially true since you've disclosed publicly that's what you're doing.

daemon132• 13 years ago

With nginx you can easily rate-limit connections, requests and downloads (which you can throttle also). Can also do this by GeoIP - country, etc.

No need for extra steps - this module shall be compiled and part of nginx-full package from nginx official PPA, if OP is using Ubuntu.

to3m• 13 years ago

"Disclaimer"?

Ideka• 13 years ago

Looks more like a "claimer" to me.

newman314• 13 years ago

What did you tweak in nginx?

huhtenberg• 13 years ago

Who toes have you stepped on recently, I wonder?

Also, pattern-wise - most of the traffic in the video seems to be hitting a single .asc file.

jbk8• 13 years ago

No idea, seriously. VLC scammers, mainly.

The .asc is a logstalgia visualisation bug, because in fact, it merges the few .exe.asc requests with the massive .exe requests

rb123452• 13 years ago

I had problems with the Windows updater apparently downloading version 2.0.6 and then not installing it. I ended up downloading and installing it manually instead. Could that be related somehow?

jbk8• 13 years ago

VLC Windows updater?

daemon132• 13 years ago

Is this originating from specific country or all over?

jbk8• 13 years ago

All over.

derefr• 13 years ago

Is there a reason VLC doesn't offer a Bittorrent download option, by the way? As far as I know VLC's audience is pretty technologically-inclined, so they would understand what a magnet link is, and you'd be able to just switch off the archive-download option for a while in cases like this. (As a bonus, if you embed a magnet link in your page, you're implicitly embedding a SHA-verification of the resulting torrent file.)

merlincorey• 13 years ago

Why do you return 403 (according to the article) instead of 444? 444 will drop and close the connection, so I am guessing it has something to do with keep alives vs connection overhead?

bentaber• 13 years ago

Is each request a unique IP or do you see frequent and recurring requests from a chunk of IPs?

etix2• 13 years ago

Depends, I would say half of them are returning every once in a while and others only do a single request and never come back. No clear pattern here.

aidenn0• 13 years ago

It it possible this is an accidental DDoS? VLC is popular to bundle with things, and all it would take is the code that checks for a new version and automatically downloads to have a bug that it always thinks there's a new version...

dave809• 13 years ago

Ubuntu 13.04 came out yesterday, the people upgrading might be reinstalling all there programs

asperous• 13 years ago

*their

I highly doubt 500 different people are upgrading ubuntu every second, but a bug in the software is possible I suppose.

jbk8• 13 years ago

Ubuntu does not download a .exe...

jbk8• 13 years ago

This is impossible, seriously. I cannot share the details, but the HTTP headers shows clearly that this is not that case.

And more than 10 millions downloads per day?

mortenlarsen• 13 years ago

Ubuntu downloads from it's own mirrors (hundreds of them), with very few exceptions for proprietary stuff that can't be distributed like Adobe Flash and ttf-mscorefonts-installer (not default). Also it would not download a .exe to install VLC.

fsckin2• 13 years ago

Pretty cool stuff! glTail [0] does similar visual analysis of pretty much anything.

[0] http://www.fudgie.org/

fudge• 13 years ago

I currently have a native OSX version og glTail in review by Apple, which is quite a bit faster and easier to install than the Ruby version. I also have an updated IOS version in the queue which doesn't crash quite as often.

fsckin2• 13 years ago

An IOS version? How cool! I'll check it out, thanks for the heads up.

dfc• 13 years ago

I was browsing HN on a friend's computer that without adblock and clicked this link. Wow! Is this what the internet looks like without adblock? The ad/content ratio is crazy...

Tobu2• 13 years ago

Without blogspam: https://youtu.be/hNjdBSoIa8k

Also follow the submitter link, currently etix seems to be most active on Twitter: https://twitter.com/etixxx

x0054• 13 years ago

Perhaps it's worth it to code a quick and dirty solution using JavaScript encryption. On your download page setup a script that would receive a given encrypted string, decrypt it with a provided key, and the use it to prepend to the download link. On the server, symbolically link the file on demand and send it to only one user, ip limited. This way the attack, though still can be automated, would require some code rewrite from that attacker, which might be beyond his/her abilities. Also, if the encryption algorithm is CPU intensive, then it wold require several seconds of CPU time per request from the attacker.

To make the decryption CPU intensive you may simply use any encryption algorithm you like, many are available as JS libraries, but instead of giving the entire decrypt key, skip the last 2 digits, and let the end user brut force the last 2 digits in the client via JS. That way there is a computational cost to each attack request.

Just some ideas off the top of my head. Not sure at the moment how to implement the server side part at the moment, but I am guessing that their are server side rules that allow you to easily set per ip access restrictions to folders or fils.

PS: please excuse spelling, typing this on my iPhone.

looneylv• 13 years ago

I guess someone took some VLC crash seriousley to the heart.... :D

Hang on guys!

verandaguy• 13 years ago

The VLC logo is a traffic cone.

That visualization sort of looks like a cone.

Coincidence?

onemorepassword2• 13 years ago

All I could think of was "this is what a DDoS attack will look like in Hollywood products for the next decade".

Awesome visualization.

dlhavema• 13 years ago

oh this isn't fantastic enough for CSI or BONES to use... not enough 3D graphics... very cool visual none the less..

GhotiFish• 13 years ago

I was just thinking, there weren't nearly enough laser sounds, polygons, or explosions.

It's not quiet there yet!

superflit• 13 years ago

I just got one of my servers attacking TicketMaster by a faulty cgi. (my alert system notified 5 minutes after it started) The mob is angry now It was disabled.. I think it has more targets that only vlc...

ck2• 13 years ago

Brave of them to disclose it's just the user-agent they are filtering.

It's not possible to inspect the user-agent via the linux firewall (iptables) is it?

I guess you can use this if your iptables supports string matching

    --string "useragent"

This is what a DDoS attack looks like

Related Stories