Dealing with DDoS attacks

Introduction

In the clan world (and RuneScape itself) there are other players who decide to to use tactics to bring more of an advantage to their side. One example of this is ddosing. It is illegal in many jurisdictions, however it's difficult (and often a waste of time) to find and prosecute the culprit, so the best course of action is to help mitigate them by reducing the effect it has on your clan.

Return to Top

What is a DDoS attack?

What has to be understood first is that ddosing is not necessarily the correct term for what is happening. This is because DDoS stands for 'Distributed Denial of Service'. DoS on the other hand stands for 'Denial of Service'. The difference is when someone makes a DoS attack, it's usually one person doing the attack while a DDoS attack is when many people perform the attack. The latter is next to impossible to trace, especially when it doesn't even need to be a group of people. They can use ghost computers that have been infected with a virus and control it like a bot army. This is called a botnet. This can be used to perform individual DoS attacks per computer. Since there are multiple computers hitting a server at a time, it becomes a DDoS attack.

Return to Top

How does a DDoS attack work?

Whenever a computer communicates with a server, the server sends information back. If this happens enough times (and fast enough) this can overload the server enough that regular service becomes slow or it may not even work at all.

Return to Top

Teamspeak Servers

A denial of service attack is common for Teamspeak servers. As you can imagine, during a fight where organization depends on Teamspeak, it can be quite disruptive should that go down. That's why they are so problematic and so common.

Secrecy

Your first line of defence will always be an unknown IP address. Publicly showing or communicating the IP of your Teamspeak will only encourage it to fall victim to an attack. There is no way for your server to be attacked if they do not know the address of it, similarly to how it is impossible to prank call a number you do not know.

Multiple Servers

One way to help deal this problem is to have multiple servers open. Thankfully with Teamspeak 3, the ability to open multiple servers at once in tabs was added to the program. If a clan is able to stay in multiple teamspeaks at once, it's only a matter of switching tabs and communication is restored (as shown below).

There are two options for switching to a server in a new tab.

The first option is through the 'Connect' menu. To access this, navigate Connections->Connect. There will be two options: Connect and Connect in New Tab. Connecting will connect in the current tab that you're in.

Your second option would be through the Bookmarks menu. To use this, just simply go to the Bookmarks menu and right-click on any server. Connect will connect in the current tab while connecting in a new tab will connect in a new tab.

Don't expect to buy multiple servers for your clan, however one good server will always work. These multiple servers can be public servers rather than your own. Chances are, they'll withstand any attacks stronger so it'll be even harder to take those down as well, especially when they're focused on taking your first one out first.

For a complete Teamspeak 3 guide click here.

Return to Top

Websites and Forums

Websites and forums are also targeted because they are the main source of communication for clan members. It not only disrupts information about events, but it can demoralize a clan. This is often more serious and requires intervention from your host. They can move your site to a new server that is both stronger and has a different address. This will be a temporary solution. If this continues, the host may activate a firewall to further protect your site. For further information, you will need to contact your host regarding mitigation.

This same method can apply to your Teamspeak server. Just keep in mind that if your server is moved, it will have a different IP address.

Return to Top

Personal Mitigation

This has become more and more prevalent. With that being said, players often mistake receiving a denial of service attack for common disconnections related to their connection, Jagex, or anything related to the previously mentioned. Often a good indicator is that you cannot connect to the Internet at all, not just Runescape.

If you believe you are being ddosed, you need to perform the following steps:

• Find your modem
• Disconnect the power cable
• Wait 30 seconds
• Reconnect the power cable

This will change your IP address.

Note: This will only work if you have a dynamic IP. If you believe you have a static IP and want a dynamic IP, it's best to contact your ISP.

Dealing with these attacks are different from preventing them. If you can prevent them, then you won't need to do deal with them, which is much more desired.

Common ways on how your IP can be found:

• If you create an account or post on a clan forum for example, your IP address will be recorded for their leadership to see. If you don't trust them with your IP address, then simply don't post or register an account at all.
• Scraper images are becoming more and more popular as well. What is a scraper image? It is an image that is hosted on a personal site that has a script that records the IP addresses of anyone that loads it. You don't need to click on a site or even register an account to give them your IP. However, in order to distinguish which IP is yours they'll often send you a link to a post or even the image directly.
• If you join a Teamspeak or Ventrilo server administrators and moderators can view your IP.

Return to Top

Credits

Original Guide by: Killerred005

Thanks to: -

Last updated by: Killerred005

Last updated on: 25-Nov-2011