Connection Stops Working - Fibre Max

Forums › Spark New Zealand (including Skinny and BigPipe) › Connection Stops Working - Fibre Max - DDOS Protection ?

Mikek

108 posts

Master Geek

#247936 3-Mar-2019 18:20

Hi All

With bigpipe full speed fibre

If i max out my fibre connection with torrent use or ftp use with overseas connections for roughly 5 mins, All links for overseas stop working and only some local links work, My internet and all trace routes stop working.

Only very few small local links work, After 5-10 Mins all links work again and torrents start up along with ftp use.

Anyone else have this issue ?

Cheers Mike

1 | 2

8960 posts

Uber Geek

#2190376 3-Mar-2019 18:22

What router? Could be overloading the NAT table.

Mikek

108 posts

Master Geek

#2190379 3-Mar-2019 18:32

I've tested two different routers, My TP-link C3150 which has not had any issues doing this with other ISP's for a few years, Plus an ASUS RT 58U which does the same but its not the best router to be fair.

Plus it is with private torrent networks so far less peers /seeders

hio77

12999 posts

Uber Geek

ID Verified

Trusted

Lizard Networks

#2190381 3-Mar-2019 18:47

Highly unlikely your torrenting is popping ddos protection - If it is your settings must be insanely poorly configured.

Are you doing something else with your connection other than torrenting?

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

cbrpilot

955 posts

Ultimate Geek

Trusted

Spark NZ

#2190388 3-Mar-2019 19:41

Do you have a Static IP, or are you using dynamic IP?

My views are my own, and may not necessarily represent those of my employer.

Mikek

108 posts

Master Geek

#2190389 3-Mar-2019 19:50

Dynamic IP -

As for hio77 - my settings are no different from what iv'e been using for years, Not that aggressive

raytaylor

4014 posts

Uber Geek

Trusted

#2190431 3-Mar-2019 20:06

Could be DDOS protection if your triggering more than 1gbit of traffic - UDP packets for torrenting can potentially do this though ftp is not likely.

Depends what the ISP end settings are is set to.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

cbrpilot

955 posts

Ultimate Geek

Trusted

Spark NZ

#2190432 3-Mar-2019 20:06

If you can PM me your IP address (assuming your connection has been stable for the last week) I can take a look if we have had any DDoS mitigations against that IP in the last week or so.

This shouldn't be the case as you have to sustain a lot more traffic than Fibre Max to be considered a DoS attack, but I agree the correlation between your experience and a standard DDoS mitigation is a little uncanny.

All this might be a complete red herring, but worth a look into.

My views are my own, and may not necessarily represent those of my employer.

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

Mikek

108 posts

Master Geek

#2190449 3-Mar-2019 20:48

I've sent a PM to cbrpilot,

Just an update this issue was most likely not caused by ftp as it was only going slowly when i checked back at the logs with my seedbox just now,

It seems to be with private torrents with 3 or 4 active around 50 seeds per torrent and sustaining 100/120meg for roughly 3-4 mins, is when i can trigger an issue, where the only links I could get to work was

akamai.spark - eg www.nzherald.co.nz was one of the only sites to work, I will test further and try and get more information,

cbrpilot

955 posts

Ultimate Geek

Trusted

Spark NZ

#2190542 4-Mar-2019 09:36

Yes indeed our systems are triggering a DDoS mitigation here. Traffic rate as reported was well in excess of 1Gbit (our threshold is obviously well north of 1Gb), thus why it was triggering.

We'll get that fixed! Give me a few days and I should have it sorted for you :)

My views are my own, and may not necessarily represent those of my employer.

cbrpilot

955 posts

Ultimate Geek

Trusted

Spark NZ

#2191376 5-Mar-2019 13:58

Update made. Give it a go now MikeK. Let us know how you get on.

My views are my own, and may not necessarily represent those of my employer.

Mikek

108 posts

Master Geek

#2191484 5-Mar-2019 18:22

Hi cbr

I have tested the issue and its working great, I pushed it more then what I would normally just to see and no more issues,

below is a 1hr graph of torrent testing that worked perfect.

Thanks for sorting this,

Mike

chaminda

10 posts

Wannabe Geek

#2203770 23-Mar-2019 11:30

I"m on spark and the same thing has happened to me. I can't download any torrents - Tried to d/l ubuntu and its just connecting to any trackers. I had a few people staying with me over the past 2 months so may have used a lot of broad band data!

Anyway I can fix this without getting a VPN?

Linux

11428 posts

Uber Geek

Trusted

Lifetime subscriber

#2203773 23-Mar-2019 11:47

chaminda:

Hi

I"m on spark and the same thing has happened to me. I can't download any torrents - Tried to d/l ubuntu and its just connecting to any trackers. I had a few people staying with me over the past 2 months so may have used a lot of broad band data!

Anyway I can fix this without getting a VPN?

I would DM @cbrpilot to take a look

hio77

12999 posts

Uber Geek

ID Verified

Trusted

Lizard Networks

#2203781 23-Mar-2019 12:08

Can't download torrents sounds like a user application issue

Not related to what dave fixed.

#include <std_disclaimer>

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

raytaylor

4014 posts

Uber Geek

Trusted

#2203807 23-Mar-2019 13:14

Thats pretty cool that the DDos protection is kicking in and working.

A torrent can work in two ways.
The typical TCP method is what we all imagine file transfers to use, however to get around throttling last decade, many torrent applications started using UDP to blast packets from seeders in the direction of the leecher.

The idea is that the UDP packets would come in from all directions as fast as possible, and bypass some throttling systems due to UDP being seen as more interactive and higher priority in some ISP systems at the time.

As the packets get closer to the user, various pipes may be congested and cause the packets to be dropped. Some of those things could include backhaul links, throttling QoS boxes and even the dsl tail line.

The packets that did get through would be verified by a checksum and the leecher would not re-request the piece of the file.

Because UDP doesnt have any acknowledgements at the protocol layer (the torrent application does it by re-requesting failed pieces of the file) seeders will just send them and hope some get through.
This means if you have a boat load of seeders its possible that the UDP traffic would be triggering the DDOS protection if its flowing through the protection box at a high enough speed before hitting the smaller pipe and a bunch of the packets just being dropped because they cant fit though (ufb tail, dsl tail, backhaul, routers)

TCP on the other hand waits for a packet to be acknowledged at the other end before sending the next, and will slowly ramp up in speed until it reaches a point where all packets are being acknowledged, so the slowest pipe sets the maximum packet rate.

This is why ftp or other protocols wouldnt trigger the DDOS protection where as torrenting did.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

1 | 2