CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 927
Comments: 25
block bottom
spacer spacer

CastleCops under DDoS and what we did
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9
 
Post new topic   Reply to topic       All -> FavForums -> General Site [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
PCBruiser

SRT Team Lead
SRT Team Lead
Forums Admin

Joined: May 11, 2005
Posts: 11678

1st Responder Mentors 1st Responders Forums Admin MIRT Moderators Premium Rootkit Experts Security Experts SRT Team CC Committee

PostPosted: Mon May 07, 2007 2:52 pm    Post subject:
Reply with quote

I think we have isolated the issue. It appears to be an Internet backbone routing issue when you are routed through Cogento routers on the backbone. Please see this:

CastleCops Link/p937074-site_is_slowing_down_needs_maintenance.html#937074

and post a trace route for Paul. That will help to pinpoint diagnose the problem.


_________________
Don't read? Can't learn!
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8865
Location: Nebraska, USA
MVP Premium

PostPosted: Mon May 07, 2007 3:12 pm    Post subject:
Reply with quote

I don't know. I seem to be getting past Cogento and hanging up at pao1.isc.org. I sent Paul 4 runs.


_________________
image Bill (AFE7Ret)
Freedom is NOT Free!

image
Back to top
View users profile Send private message
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8865
Location: Nebraska, USA
MVP Premium

PostPosted: Tue Jun 19, 2007 3:08 pm    Post subject:
Reply with quote

Some of today's stats:

58ppm 54.167s (52.237s)
113ppm 18.826s (16.981s)
142ppm 27.348s (20.978s)
116ppm 18.704s (16.856s)

Then, to illustrate the inconsistencies:

165ppm 4.334s (3.662s)
182ppm 0.940s (0.563s)
175ppm 0.355s (0.107s)


The DDoS was more than 4 months ago in February. Are the frustrating problems we are still experiencing still the result of the attack?

I'm fortunate that I have a pretty good understanding of computers, the IT industry, and how to be safe, so I don't come here seeking advice, but rather to offer my help. It makes ME feel good if I can help someone have a safe computing experience. Okay, that's selfish, but that's the way it is.

Don't get me wrong - I appreciate the opportunities we have here, and I have no doubt all those involved in getting the site back up to speed are working hard at it, and are just, if not more, frustrated.

I can't speak for anyone else, but 4 months of nagging delays takes much of the enjoyment out of volunteering time here.

What is left to be done? How can we help?


_________________
image Bill (AFE7Ret)
Freedom is NOT Free!

image
Back to top
View users profile Send private message
Paul

CastleCops Founder


Joined: Feb 22, 2002
Posts: 27348

Administrators Firetrust Forums Admin MIRT Moderators MVP Phishing Squad Premium Team CC Committee

PostPosted: Tue Jun 19, 2007 6:37 pm    Post subject:
Reply with quote

220ppm 0.424s (0.081s)

We're still not out of the tunnel yet, but we have certainly come a long way. There is still more work to do.

I can get MySQL to look at the problem, but the fees are a lot.


_________________
Paul Laudanski - http://www.laudanski.com
http://www.linkedin.com/pub/1/49a/17b
Back to top
View users profile Send private message Send email Visit posters website
Paul

CastleCops Founder


Joined: Feb 22, 2002
Posts: 27348

Administrators Firetrust Forums Admin MIRT Moderators MVP Phishing Squad Premium Team CC Committee

PostPosted: Tue Jun 19, 2007 6:43 pm    Post subject:
Reply with quote

Also take note, as of 1 - 2 weeks ago since a couple key updates took place, our traffic has doubled on a per hour basis (on average). Also, we had over 100k PIRT urls submitted last night and our background scripts are running processing them -- but that normally has no significant impact. Right now what is typically happening is some of the php scripts are running harder then they probably should be for certain connections -- and that goes back to optimizations.


_________________
Paul Laudanski - http://www.laudanski.com
http://www.linkedin.com/pub/1/49a/17b
Back to top
View users profile Send private message Send email Visit posters website
Bill_Bright

General
General
Premium Member

Joined: Jan 16, 2004
Posts: 8865
Location: Nebraska, USA
MVP Premium

PostPosted: Tue Jun 19, 2007 9:25 pm    Post subject:
Reply with quote

158ppm 2.733s (0.238s) - Very Happy

Quote:
Also take note, as of 1 - 2 weeks ago since a couple key updates took place, our traffic has doubled on a per hour basis (on average).
Thanks for the reply.

Question - this doubling/hour in the last couple weeks, how does that rate compare to pre-attack rates? It appears to me, since the attack, traffic in the forums (at lease those I frequent) has dropped significantly, I suspect out of user frustration causing them to seek answers elsewhere. But as you noted, there have been recent improvements, possibly bringing folks back.

BTW - just before lunch, I marked all forums as read then stepped away from my computer. When I sat down now for this session, I clicked on "New Forum Posts" to see what was new - your two replies were not listed - I only knew about them from email notifications. Only 5 in HJT and 1 in Sunbelt came up on the new list . Upon further investigation, I see there is also one new post in GCP, 2 in Spam and probably some others. It would seem that function is not working correctly either.

Edit add: 192ppm 17.162s (15.938s) for the original submit. Sad


_________________
image Bill (AFE7Ret)
Freedom is NOT Free!

image
Back to top
View users profile Send private message
Paul

CastleCops Founder


Joined: Feb 22, 2002
Posts: 27348

Administrators Firetrust Forums Admin MIRT Moderators MVP Phishing Squad Premium Team CC Committee

PostPosted: Wed Jun 20, 2007 2:11 am    Post subject:
Reply with quote

I don't trust that new replies thing and instead use the egosearch.

I think part of the traffic increase has been due to the ability for crawlers to access the site quicker, thereby showing better results in search pages.


_________________
Paul Laudanski - http://www.laudanski.com
http://www.linkedin.com/pub/1/49a/17b
Back to top
View users profile Send private message Send email Visit posters website
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16431

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Wed Jun 20, 2007 4:32 am    Post subject:
Reply with quote

Paul wrote:
I can get MySQL to look at the problem, but the fees are a lot.

I thought you were changing to SQL?


_________________
imageCastleCopsWiki
Back to top
View users profile Send private message
Paul

CastleCops Founder


Joined: Feb 22, 2002
Posts: 27348

Administrators Firetrust Forums Admin MIRT Moderators MVP Phishing Squad Premium Team CC Committee

PostPosted: Wed Jun 20, 2007 12:44 pm    Post subject:
Reply with quote

Changing to SQL?


_________________
Paul Laudanski - http://www.laudanski.com
http://www.linkedin.com/pub/1/49a/17b
Back to top
View users profile Send private message Send email Visit posters website
dsf

Guest
IP: 199.211.*.*






PostPosted: Thu Jun 28, 2007 1:53 am    Post subject: mysql / PHP
Reply with quote

Hi, I was asked by faith_michele to help if I can with some of your latency issues. I am a fellow Norwich MSIA student with her.

Anyway, I am mostly a .NET developer, but have some experience with PHP and MySql. I don't know how much or how little experience you all have so will just ask some very general questions first:


PHP: There are a lot things that can be done to optimize code but...

What version are you using? 4.x, 5.x?

What OS is the site running on? Linux? Windows?

Are you using a PHP framework, like CakePHP, or scripting natively? Sometimes frameworks, while making development relatively easy, can result in excessive function calls, as you need to work through multiple layers of abstraction.

Is your PHP being run with FastCGI? This essentially enables the runtime to reuse code without having to run the interpreter each time. There is also something called the Zend Optimizer, that supposedly speeds up execution times, but I am not real familiar with it.

MYSQL:

Very basic, but are all your tables fully indexed? Lack of indexes is the biggest cause of db latency. At the very least you should index your primary key, and one other column that would be most relevant.

Hope some of this helps

Back to top
faith_michele

PIRT Handler


Joined: Dec 26, 2005
Posts: 2529

MVP Phishing Squad

PostPosted: Tue Jul 10, 2007 6:05 am    Post subject:
Reply with quote

It is a very busy week (assignments due) this week. Paul, dsf offered to help and I can have him directly email you, if that is okay. Very Happy

Back to top
View users profile Send private message Send email
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> General Site All times are GMT
Goto page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9
Page 9 of 9

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer