[RFO] Fresco Outage - 08/27/2011

[Michael D.]

This morning the Fresco server was hit by a DDoS again. We've noticed a pattern of the DDoS attacks and they've all been hitting the same IP address over the last few months. The IP address that was being hit did have a considerable amount of customers on it originally, however, we've been shifting clients off of that IP and dispersing them to lower-population addresses. This allows two things:

1. When whoever is under attack by these malicious individuals is hit again, there are less other clients and sites affected.
   
2. It's helping us narrow down who is actually the target of the attack (it's not us, but a site we host).
   

The attack was large enough that the system wasn't able to keep up so our technicians made some changes to allow the system to keep track of more packet information in attempts to keep the good packets from being ignored or dropped. Unfortunately a typographical error was made and one of the parameters was set far too large which lead to the server exhausting it's available RAM and essentially crashing.

 

After the server crashed it was rebooted and due to the nature of the crash and reboot the file system was not cleanly shut down resulting in a required file system check. The file system check took approximately an hour and did fix a few minor issues, however, there was no data loss. Once the server was back online we continued to work to shift accounts off of the affected IP and dispersing them onto various low-population IP addresses.

 

I can assure you that we're as upset about this incident as you are and the repeated attacks on the IP address that was affected and we are doing everything we can to identify the target. Unfortunately due to the nature of the attack only junk data packets are being sent to the server which does not identify the site which is under attack and only attempts to flood the server with junk packets and is doing so on an IP that had numerous accounts.

 

If you have any questions about this at all, do feel free to ask them as we will be more than happy to address your concerns.

 

Thanks,