Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


PHP-Friends / Problem with lots of data transferred
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

PHP-Friends / Problem with lots of data transferred

fLoofLoo Member
edited September 2019 in Outages

Hey guys,

i've just got my 2nd PHP-Friends VPS and have one serious problem. Once i start a data transfer with full line speed (gbit), the IP gets blackholed for ~ 1 hour until it is accessible again. I've seen this behavior only for V4 not V6.

Behavior already starts with ~ 500-1000 Mbyte transferred.

Anyone else encountered this? Server is up and accessible via local console (via VNC) during this time without a problem. From server -> outside the connection gets dropped aswell.

Nothing in dmesg or messages.

Cheers.

Thanked by 1receivedthanks

Comments

  • MasonRMasonR Community Contributor

    Sounds like your tripping their DDoS mitigation, resulting in a false positive and subsequent black holing. Would have to reach out to their support to get them to adjust their filters/detection parameters to prevent this as I doubt it's something you can do locally on the VPS.

    Thanked by 2fLoo receivedthanks
  • dfroedfroe Member, Host Rep

    Smells like some kind of "poor man's anti-abuse mechanism" by counting packets per minute or similiar and automatically blackholing the IP for a certain time span if the rate spikes above a certain treshold.

    Of course that's just a best guess based on your description.
    I'd raise a ticket with them and ask for clarification and fix.

  • I had the same identical exact issue with Wishosting. Ended up just asking for money back

    Thanked by 1receivedthanks
  • Contact support.

    I've sorted it out with all providers I've encountered.

    Thanked by 2fLoo receivedthanks
  • @edfox said:
    I had the same identical exact issue with Wishosting. Ended up just asking for money back

    let fuck this provider with my shit comment

  • exception0x876exception0x876 Member, Host Rep, LIR

    @edfox said:
    I had the same identical exact issue with Wishosting. Ended up just asking for money back

    Can confirm the problem was DDoS mitigation. It was fixed eventually.

  • We could try to call @PHP_Friends

    Thanked by 1receivedthanks
  • dataforestdataforest Member, Patron Provider

    Please contact our support, if there's a problem we will fix it.

  • @exception0x876 said:
    Can confirm the problem was DDoS mitigation. It was fixed eventually.

    Was I the only one affected, or just the first one that reported it?

    Thanked by 1receivedthanks
  • @PHP_Friends said:
    Please contact our support, if there's a problem we will fix it.

    Already done. Appreciated :wink:

    Thanked by 1receivedthanks
  • @PHP_Friends said:

    where are your latest specials?

    Thanked by 1receivedthanks
  • dataforestdataforest Member, Patron Provider

    Thanks, my colleagues will check this.

    Best Regards,
    Tim

    Thanked by 2pike receivedthanks
  • dataforestdataforest Member, Patron Provider

    @ehab said:
    where are your latest specials?

    Currently we sell more servers than we can deliver, as soon this is back to normal a special might come :)

  • exception0x876exception0x876 Member, Host Rep, LIR

    @edfox said:

    @exception0x876 said:
    Can confirm the problem was DDoS mitigation. It was fixed eventually.

    Was I the only one affected, or just the first one that reported it?

    There were a few people reporting it.

    Thanked by 1receivedthanks
  • solairesolaire Member
    edited September 2019

    @edfox said:

    @exception0x876 said:
    Can confirm the problem was DDoS mitigation. It was fixed eventually.

    Was I the only one affected, or just the first one that reported it?

    I had the same issue months ago but chose to not ticket it in but rather cancel the box. Figured it was because I was using more bandwidth than allotted according to the ToS (I believe 1/8th of 250 Mbps?). Probably should've reported it in, box was great apart from this issue. Glad to see it's solved now.

  • PHP_Friends said: Currently we sell more servers than we can deliver

    LET life. So, when those discounted goodies will come?

    Thanked by 1receivedthanks
  • pikepike Veteran
    edited September 2019

    It's already a damn good price for what you get. + @PHP_Friends has no provider tag yet.

    Thanked by 1receivedthanks
  • I had this issue with Dacentec. Even after talking to their support it was a dead end. They told me that my server was on a 1gbps, that it would not take more then that, yet when I was sending it data I was getting banned for hitting 2gbps tripping DDoS. Told me its my fault and it would clear every hour it tripped. Made transfering data non existent.

    I've been very very happy with php-friends thoe. If only the vps I had, had just a bit more storage to it then it would be perfect.

    Thanked by 1receivedthanks
  • princeshoko said: had this issue with Dacentec. Even after talking to their support it was a dead end. They told me that my server was on a 1gbps, that it would not take more then that, yet when I was sending it data I was getting banned for hitting 2gbps tripping DDoS. Told me its my fault and it would clear every hour it tripped. Made transfering data non existent.
    I've been very very happy with php-friends thoe. If only the vps I had, had just a bit more storage to it then it would be perfect.

    The issue wasn't the rate of the data you were transferring, the problem was the amount of packets per second. You were effectively tripping the packet per second check for the DDOS system leading it to believe you were getting DDOSed. This results in being null routed for an hour. It is completely possible to push 1Gbit full there as long as your not doing it over UDP or pushing hundred of k packets per second over TCP, which it sounds like you were probably doing.

    Now, if you were only occasionally hitting high PPS and you could prove this, they WILL disable the DDoS protection for you, however, if you get hit with a real DDOS you will be charged for traffic over your allotted amount and if you start being abusive pushing hundred of thousands of packets per second all the time, they will put it back in place or ask you to leave.

    There really shouldn't be a reason you have such high PPS unless your doing something like running a huge seed box that's maxing the connection all the time or constantly running iperf or something that uses high PPS constantly (which is obviously against their TOS, so it wouldn't surprise me to find out the way they combat these types of customers is to leave this filter in place so they leave).

    I have had services from Dacentec for several years now and haven't encountered this issue except when I first got the server and was doing a bunch of high PPS iperf test which would trigger their DDOS protection. After finding out from support this was the cause, I have been able to work around it without any issues.

    my 2 cents.

    Cheers!

Sign In or Register to comment.