This is not a DDOS, Tell the truth SE.

Quote:

---

Originally Posted by Shipp

I have trouble believing it's a DDoS for the simple fact that everytime people drop, it's always the same people kicked and the same people not affected. That seems more like some type of ISP issue or something else other than a DDoS on the game itself.

---

DDoS attacks rarely attack the game servers directly and instead hit a particular internet node. This causes only certain people that connect via that node to be affected by the DDoS attack.

Unfortunately, in many of these cases Square Enix has little control over these issues as it's outside of their network, yet people will blame them anyways because they don't understand the specifics as to why they got DC'd and cannot reconnect.

Has SE said anything? Getting real sick and tired of not being able to do stuff. The DDOS attacks, if they are that, are getting more and more frequent. The NA data centres have been hit every day this entire week alone!

Quote:

---

Originally Posted by SicariusSeven

Has SE said anything? Getting real sick and tired of not being able to do stuff. The DDOS attacks, if they are that, are getting more and more frequent. The NA data centres have been hit every day this entire week alone!

---

They just said what they usually say.

Quote:

---

We are currently experiencing technical difficulties due to a DDoS attack.

We are looking into the way attacks are being made and taking countermeasures. More information will be provided as the situation develops.

---

Unlike the previous one from the day before (the 4th), this one from the 5th didn't have a followup - which means they don't believe it's had a resolution. It's been about 5 days since that notice.

Quote:

---

Originally Posted by Shipp

I have trouble believing it's a DDoS for the simple fact that everytime people drop, it's always the same people kicked and the same people not affected. That seems more like some type of ISP issue or something else other than a DDoS on the game itself.

---

It's the NA DCs so probably one of the major nodes or the ISP that they use for NA getting DDOS'd. It's also affecting other games. My hubby has had issues in Fallout 76. And usually when we have issues, he has issues there and vice versa. So probably using the same NA backbone.

Quote:

---

Originally Posted by DaKitten

A DDOS in pretty much all scenarios is a consistent denial of service attack, if it were happening it would not be as inconsistent as this "DDOS" is.

Even with DDOS protection in place, it would still not be this inconsistent.

This is a server overload or server hardware issue, I'm not buying the excuse.

Please fix the actual problem.

---

Well, there are some guy that fills Limsa with naked roegadyn to show off its hate for lalafells and thousand bots under the city connected while legit players who do want to connect or just play the game s/he paid for can't because that guy must waste that connection with that.

Frankly, S-E should actually do something about this. A server that makes me wait in a queue to log-in to a server where almost no one is playing. If I go to Kugane to see the "max level" trial players, I see no one there. If I go to Tulliyolal, no one. If I go to Limsa, the game's hub, almost no one besides that naked roegadyn. But the server is slow with so many connections.

Quote:

---

Originally Posted by miraidensetsu

Well, there are some guy that fills Limsa with naked roegadyn to show off its hate for lalafells and thousand bots under the city connected while legit players who do want to connect or just play the game s/he paid for can't because that guy must waste that connection with that.

Frankly, S-E should actually do something about this. A server that makes me wait in a queue to log-in to a server where almost no one is playing. If I go to Kugane to see the "max level" trial players, I see no one there. If I go to Tulliyolal, no one. If I go to Limsa, the game's hub, almost no one besides that naked roegadyn. But the server is slow with so many connections.

---

The network packets of idling characters would contain less data than that of active players - those checking retainers, those practicing rotations on striking dummies, those dodging raid boss mechanics. More activity means more data must be transmitted. You should be thanking the roe bots because their connections actually alleviate server load.

He would actually alleviate server load if he just disconnect and go play something else.

And bots is a bigger problem on this matter. And S-E does almost nothing about that.

Quote:

---

Originally Posted by caffe_macchiato

Facts in support of DDOS:
- WoW just introduced a premium currency and a lot of people are upset. Usually, a DDOS coincides with bad news in WoW.
- A lot of bots got banned, so the bot owners are taking it out on FFXIV.
- We correctly deduced that "other" countries like Malaysia, Philippines, etc. were behind last year's DDOS due to the payment processor change. Maybe they're still having trouble paying their subs?

Facts in support of server overload:
- FFXIV is still the world's most popular MMO with over 30 million players (WoW, in comparison, only has around 3 million). We know that Square Enix did not anticipate FFXIV being this popular.
- A lot of people are running the new deep dungeon (if the game world feels empty, this is why).

---

Okay I'll bite the bait. Where did you get this meme 30 million number from?

Quote:

---

Originally Posted by miraidensetsu

He would actually alleviate server load if he just disconnect and go play something else.

And bots is a bigger problem on this matter. And S-E does almost nothing about that.

---

You have problems and the weeb police are not those problems, my duder.

Quote:

---

Originally Posted by Espon

DDoS attacks rarely attack the game servers directly and instead hit a particular internet node. This causes only certain people that connect via that node to be affected by the DDoS attack.

Unfortunately, in many of these cases Square Enix has little control over these issues as it's outside of their network, yet people will blame them anyways because they don't understand the specifics as to why they got DC'd and cannot reconnect.

---

"Square Enix has little control."

Yes. The only game where this regularly happens for multiple years long now.

Quote:

---

Originally Posted by RedDeathXR

"Square Enix has little control."

Yes. The only game where this regularly happens for multiple years long now.

---

Not how that works. Read at LEAST just one page back lol

Quote:

---

Originally Posted by caffe_macchiato

Facts in support of DDOS:
Facts in support of server overload:
- FFXIV is still the world's most popular MMO with over 30 million players (WoW, in comparison, only has around 3 million). We know that Square Enix did not anticipate FFXIV being this popular.

---

In which fantasy are you living. WoW is still n°1 by far. and XIV does not have 30 millions players. Maybe created character, even maybe 30 millions account created since 1.0. But the player count is estimated between 1 and 2 millions actives players.

WoW is around 3 million active players.

Quote:

---

Originally Posted by RedDeathXR

Yes. The only game where this regularly happens for multiple years long now.

---

Sony has a big ddos on their PSN fairly often, which is a significantly larger platform and affects a lot more games.

Valve had team fortress 2's matchmaking being unplayable due to cheating bots for over 6 months straight. No mitigations were taken for a very long time. The only reason it didnt die was because private servers were still a thing there.

Each game has their own problems, and especialy if you have to maintain the servers yourself, and its a game with a lower player count than the top tier games, you are vulnerable to this. Mitigation hardware isnt cheap and has a constant cost going on (you usualy hire this). At expansion releases you know loads will be higher, and ddosses being more likely, so you prepare ahead of time, but this is like a random time, making it almost unpredictable when it would happen. And if they made it severe enough, you cant mitigate against it quickly.

SE only has control if these servers have overlap with many games, as the more the server needs to do, the higher its investment into protecting it against attacks. DT made a big dent in the player base in popularity, which means either massively overpaying for capacity you dont need, but being ddos protected, or reducing costs and hire the mitigations when the ddos happens. You can be sure which one management prefers 99% of the time.

There is no middle ground, as either a ddos is strong enough, or it isnt. If it is too strong, then you need those mitigations, otherwise you dont. Any extra capacity beyond preventing the ddos is like it doesnt exist, a huge cost sink. And im not sure if that cost sink is worth it to pay extra for.

The nightmare corpse-city of R'lyeh has been unsealed. Cthulhu stirs from his dark slumber. All of creation shall tremble and weep. Reality and sanity as we know it shall cease to exist. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn!

...

This may also cause intermittent connection issues with Final Fantasy XIV. An extremely specific and odd side effect. Cthulhu apologizes for any inconvenience and hopes you can find some other flitting inconsequential distraction so he may continue his dark works unnoticed and unabated.

Quote:

---

Originally Posted by CNitsah

WoW is around 3 million active players.

---

9 million actually according to recent, seemingly official, leaks and XIV is likely not even hitting a full 1 million from what we can deduce from the numbers we have

Quote:

---

Originally Posted by DaKitten

This is a server overload or server hardware issue, I'm not buying the excuse.

---

Oh is this why the servers can't sustain us?
Unexpected player gain

https://i.imgur.com/jPV1xXB.png

If its not DDoS attacks, it's NTT being an absolute dog's arse of a ISP.

Quote:

---

Originally Posted by MisterNublet

If its not DDoS attacks, it's NTT being an absolute dog's arse of a ISP.

---

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

Quote:

---

Originally Posted by Catwho

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

---

The boots haven't knocked me offline once. It leads me to believe it is an attack on one of the ISP nodes instead of the servers themselves. I've maintained connection every single mass DC.

Quote:

---

Originally Posted by Catwho

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

---

Yep and AT&T was affected by that node for some time when our turn came around and Verizon experienced it. It hits certain ISPs at different times. And then just clears up one day. There's a huge thread about it on the tech forums.

That node is notorious but usually causes massive lag and not constant disconnects. Constant disconnects are usually DDoS. And you're right about the lobby servers. If you give it a second before trying to go back in you can usually get by without the lobby server crashing on you.

Just another reminder to everyone, Materia is not getting DDOS'ed atm. Highly suggest visiting it.

Quote:

---

Originally Posted by DaKitten

A DDOS in pretty much all scenarios is a consistent denial of service attack, if it were happening it would not be as inconsistent as this "DDOS" is.

Even with DDOS protection in place, it would still not be this inconsistent.

This is a server overload or server hardware issue, I'm not buying the excuse.

Please fix the actual problem.

---

The thing is, it is very hard to ward against DDoS attacks, even with protection... more gateways to get to the server could help on it though... however that would mean more access codes for players as in having 3 different login in seequenze.. going from lobby 1 to lobby 2 and then into the game... however the DDoS would just hit lobby 1 in massive means if anything.

Just saw in the news today they're laying off 170 employees in the UK and an undisclosed amount in the US to make room for AI QA testing. https://www.reddit.com/r/cscareerque...s_wants_70_of/

Maybe that has something to do with it.

Quote:

---

Originally Posted by TacoRemix

Just saw in the news today they're laying off 170 employees in the UK and an undisclosed amount in the US to make room for AI QA testing. https://www.reddit.com/r/cscareerque...s_wants_70_of/

Maybe that has something to do with it.

---

As balmungs resident CatGPT, This Ai layoff does not bode well for us Ai's.

Quote:

---

Originally Posted by Themarvin

The thing is, it is very hard to ward against DDoS attacks, even with protection... more gateways to get to the server could help on it though... however that would mean more access codes for players as in having 3 different login in seequenze.. going from lobby 1 to lobby 2 and then into the game... however the DDoS would just hit lobby 1 in massive means if anything.

---

Once upon a time I saw a real time map that monitors DDoS attacks around the globe. I wonder if it's still out there...?

(searches)

Oh hey look it's still around! https://www.netscout.com/ddos-attack-map

If you click on the one around Sacramento, you can see the details. We're getting ass blasted by a node in Poland. But that's just the final hop before it hits us - those botnets are sourced from around the globe before they smack the Sacramento data center.

Because that's what a DDoS is - a distributed denial of service attack. A thousand virus laden machines getting turned into a weaponized firehose of data packages.

And here we are again. Mateus just went boom. How's everybody else doing? :confused:

Quote:

---

Originally Posted by Catwho

Once upon a time I saw a real time map that monitors DDoS attacks around the globe. I wonder if it's still out there...?

(searches)

Oh hey look it's still around! https://www.netscout.com/ddos-attack-map

If you click on the one around Sacramento, you can see the details. We're getting ass blasted by a node in Poland. But that's just the final hop before it hits us - those botnets are sourced from around the globe before they smack the Sacramento data center.

Because that's what a DDoS is - a distributed denial of service attack. A thousand virus laden machines getting turned into a weaponized firehose of data packages.

---

Wish we could signal boost comments like this one. So much misinformation going around about these attacks.

In a way, I'd almost prefer it if the game were severely lagging or if disconnects were happening way more frequently. It would be easier to decide to just log off and do something else... but instead, I just log back in and get annoyed when I inevitably get disconnected a while later again. I've had 8 90k's in the last 3 days.

New excuses just got unveiled in the past 24 hours:
- It's Poland (source: four posts up)
- The U.S. Federal Government runs the nodes, and since the government is shut down, it can't handle DDOS protection (source: /r/ffxivdiscussion)

I believe this is a violation of Article 5 of the NATO Charter.

Quote:

---

Originally Posted by caffe_macchiato

New excuses just got unveiled in the past 24 hours:
- It's Poland (source: four posts up)
- The U.S. Federal Government runs the nodes, and since the government is shut down, it can't handle DDOS protection (source: /r/ffxivdiscussion)

I believe this is a violation of Article 5 of the NATO Charter.

---

I think it's time to lay off the Cocoa Puffs.

The only weird thing I noticed about it is that seems to only be affecting PC players.

I'd be sitting here playing on PS5, and suddenly swaths of people in the FC suddenly dip out, or I'd be doing some content and the entire party except for me and anyone else on PS5 would disappear.

Quote:

---

Originally Posted by Shinku_Tachi

The only weird thing I noticed about it is that seems to only be affecting PC players.

I'd be sitting here playing on PS5, and suddenly swaths of people in the FC suddenly dip out, or I'd be doing some content and the entire party except for me and anyone else on PS5 would disappear.

---

Sounds like a lucky coincidence. My husband plays on PS5 and he's been raging over frequent kicks and lag spikes all week.

I notice it starts at like 9 or 10 pm pst almost everyday this week, it seems like DDoS to me.

In all likelihood it is a bit of column A and a bit of column B. The server drops always happen at the busiest times on the server, which could be either the DDOSers picking those times in particular or the servers just buckling naturally.
But they also are not doing anything to stop it.
I used to play WOW and a few years back they had a huge problem with DDOSing, I think during Legion? The impact was very different, though. The offenders took the servers down for practically days at a time until they were properly rebooted to relieve the stress, then they started all over.
But they fixed it.
I am not someone with deeper understanding of how these things work but I have never played a game that has had such consistent problems for so long. From my understanding and how things were explained back then the best way to deal with DDOS issues is upping server capacity and having a different kind of queue, not directly connected to the main server load, so that if the login queue crashes the game does not poop its pants at the same time.

The almost on-the-hour disconnects do look like DDOS but it could also plausibly be people logging in for specific timed things. With how shoddy the servers are - let's not kid ourselves, this has been an issue since, well, always - that could also be the cause.
Looking at the player distribution on NA servers it is pretty clear that, if they are perma-locking specific worlds (all of aether and pretty much all of crystal) that means they can tell the server will not be able to handle more, which is odd given that the servers are overall emptier than they have ever been. Even in the evening everything but the main aetherytes in the three capitals is dead. You can see it in the way the marketboard flows, too, and in how empty FCs are.

Active subs sadly, in the case of this particular MMO, due to the way they handle housing, does not realistically count players. Me and a friend took a year break and we had subs because we owned homes. I have been combing over the forums since I returned - mostly because of this exact problem - and we are clearly not the only ones.

So in conclusion.
It does not matter if it is outside meddling.
SE is clearly not doing anything about it. They have made pretty clear that they care very little about their western audience despite the disproportionate amount of players here vs on the japanese servers. That kinda is an issue with non-western gaming companies in general. The fact that they do not have native representatives here who actually have decision making powers and influence the way the game is being developed and optimized speaks volumes. CC tickets going overseas as well - why? All of this leads me to believe that we are having an issue of being abandoned to our troubles, not that they are powerless. We are paying them, that is all they care about. It sucks because I adore this game and I promise this criticism is coming from a place of love.

Quote:

---

Originally Posted by FeyFavilla

SE is clearly not doing anything about it. They have made pretty clear that they care very little about their western audience despite the disproportionate amount of players here vs on the japanese servers.

---

I mean they refused to even acknowledge there was an issue with RMT bots until Yoshi P got solicited by one during a livestream on NA servers, so yeah, they won't feel compelled to do anything unless it happens to them directly during a visit to the NA servers, which won't ever happen for the same reason that the JP servers don't ever get attacked.

Quote:

---

Originally Posted by Shinku_Tachi

The only weird thing I noticed about it is that seems to only be affecting PC players.

I'd be sitting here playing on PS5, and suddenly swaths of people in the FC suddenly dip out, or I'd be doing some content and the entire party except for me and anyone else on PS5 would disappear.

---

I believe this was answered before but someone mentioned that the PS network has a minor different connection. It connects to the FF server through the PS network. So players don't get the same errors unless the servers are 100% down. That being said if something happens to the PS Network, then PS players are boned until that gets back up. Cause apparently some people on VPNs and cloudflares also avoid the DDOS.

Quote:

---

Originally Posted by Darkshade

SE doesn't need you to defend them, they can do it that themselves

---

I am not defending them; I am simply stating facts that many people may not really understand. I deal with attacks such as this frequently in my profession, so I know a thing or two about them and how they work.

I get that ddosing is hard to defend against, and all the 'well amazon gets ddossed a few times a year' stuff, but-

When are players going to be compensated with time for the amont of ddosses happening. I cant comfortably do content without a ddoss resetting progress or causing issues to the gameplay. Consistently. I pvp a lot, you dc, your bh is reset and your role actions are set to something else.


If we are losing game time, why arent we beign compensated. Once again. I do not care what happened in arr, hw, sb, or shb with ddosses. This is here and now and the game has a larger pool of players then then. The whole "well back in the day same issue thing" doesnt fly. Stop using it.

We need the issue either fixed or re-compensated for the incovneinces. At this point, even a letter from yoshida talking about the ddossing going on would help.

There is no if-so-or what about it.

We're being DDOSed again. Happened at 9:06 CST. Please stop ignoring us.

And we got another DDOS on November 11. I thought along with the patch update, they would fix this problem but I guess not :(

I do think we should be compensated when it's pretty much like a week of DDOS already and especially the newest content is Deep Dungeon