DDoS two hours after the patch goes live is ridiculous

[ServerCollaps]

EU player here, everything runs smooth and nice uwu

[YumieYumiki]

How come it's only the NA servers getting DDoS'd? I mean if it's targetted at the game I think EU/JP might get some too right?

Because it might simply be that their infrastructure cant handle the load, rather than the work of bad actors. (Heck you can still technically call it DDoS even in that case, although the term DDoS usually have undertones of being an intentional form of sabotage)

[YumieYumiki]

Honestly, this isnt Square Enix's fault.

How do you know?

[PaulusHamsteru]

Honestly, this isnt Square Enix's fault. It's the fault of whatever person refuses to let others enjoy the things they pay for. They aren't hurting Square Enix (if that was their intent), they are hurting the players. But I digress, while Square Enix can mitigate it to some degree they can only do so much.

No, this is entirely on Square.

[Ayan_Calvesse]

How do you know?

How do you know its not?

I mean if we think about it - the fact is that some servers run smooth as butter. To assume it is squares fault you'd first have to assume they are lying about the DDOS attacks. To assume it isn't you need to only really believe they are not unequivolcally deceiving their player base.

As for it being a DDOS; probably is and given the passion of FF XIV players and those that are spiteful in it I would not be surprised if someone that got banned for RMT and a mountain of disposable wealth is just like "well screw em all." thats to say nothing of corporate espionage which is very common in Japan. Consider where the DDOS happens - the NA servers which have the largest consistent population - if the issue was hardware based outages; then you should be seeing the DC's happen whenever the traffic hits similar levels - which we don't according to online graphing. So *something* is pushing the DC waves to hit - and it almost seems scheduled which means its not something the general player base is doing because then it should be able to be tied to some sort of benchmark we seem to hit - but its hard to believe we hit the SAME benchmark every night at 8pm EST on Crystal for example; and only on weekdays.

Really its not viable to consider something outside of a bad actor - the only other suggestion is some automated process like a back-up is scheduled at the time this seems to consistently occur; but if that were the case then what about all the NA servers that do not get hit? Its possible Dynamis for example doesn't get hit because its on a different schedule; or newer hardware - but then why not aether? That to me suggests it is somehow targetted - just seems too many things lining up at once.

[YumieYumiki]

How do you know its not?

I don't. I'm not claiming to have a definite answer, but occams razor suggests it's more likely to be that the servers cant handle the load

I mean if we think about it - the fact is that some servers run smooth as butter.

Yes, those in EU and JP, which are much less populated.

To assume it is squares fault you'd first have to assume they are lying about the DDOS attacks.

Have they said that the disconnects occuring since 7.4 deployment are DDoS attacks? Keep in mind that from a end user pov, the symptoms of a DDoS attacks and the symptoms of the servers simply buckling under legitimate load are exactly the same.

As for it being a DDOS; probably is and given the passion of FF XIV players and those that are spiteful in it I would not be surprised if someone that got banned for RMT and a mountain of disposable wealth is just like "well screw em all." thats to say nothing of corporate espionage which is very common in Japan. Consider where the DDOS happens - the NA servers which have the largest consistent population - if the issue was hardware based outages; then you should be seeing the DC's happen whenever the traffic hits similar levels - which we don't according to online graphing. So *something* is pushing the DC waves to hit - and it almost seems scheduled which means its not something the general player base is doing because then it should be able to be tied to some sort of benchmark we seem to hit - but its hard to believe we hit the SAME benchmark every night at 8pm EST on Crystal for example; and only on weekdays.

Really its not viable to consider something outside of a bad actor - the only other suggestion is some automated process like a back-up is scheduled at the time this seems to consistently occur; but if that were the case then what about all the NA servers that do not get hit? Its possible Dynamis for example doesn't get hit because its on a different schedule; or newer hardware - but then why not aether? That to me suggests it is somehow targetted - just seems too many things lining up at once.

Or the servers cant handle the load resulting from a spike of activity caused by the patch release. Occams razor suggests this is more likely than your novel sized wall of speculation.

[Jeeqbit]

Honestly, this isnt Square Enix's fault. It's the fault of whatever person refuses to let others enjoy the things they pay for.

It's not their fault if they get attacked, but it is their fault if they don't do anything about said attacks after years of them happening and causing significant disruption.

It's a bit like saying it's not the police's fault if criminals commit a crime. Of course it's not their fault, but if they do nothing about the criminals, then over time, it becomes their fault.

They aren't hurting Square Enix (if that was their intent), they are hurting the players.

It does when people say they are quitting the game over it, which recently, I have begun to see.

The deep dungeon change was a start but it's not enough even for deep dungeons, because if you disconnect while near an enemy or a patrol goes by, it'll still kill you before the character disappears. Also, if you briefly get a disconnect icon while moving out of a conal AoE, it doesn't prevent that from ruining a solo run either (this destroyed my HoH solo run near the end).

At best it will prevent DDoS from ending most full-party runs.

Square Enix can mitigate it to some degree they can only do so much.

Given how long it has been going on, measures such as moving data center could be considered. Especially considering nobody was happy with the move because the ideal location is in the middle of the US not on the edge that gives some players unnecessarily high ping. From a player perspective, we're hard-pressed to find a benefit to having moved the NA data center to its current location.

[Ayan_Calvesse]

I don't. I'm not claiming to have a definite answer, but occams razor suggests it's more likely to be that the servers cant handle the load


Yes, those in EU and JP, which are much less populated.



Have they said that the disconnects occuring since 7.4 deployment are DDoS attacks? Keep in mind that from a end user pov, the symptoms of a DDoS attacks and the symptoms of the servers simply buckling under legitimate load are exactly the same.



Or the servers cant handle the load resulting from a spike of activity caused by the patch release. Occams razor suggests this is more likely than your novel sized wall of speculation.

They haven't spoken regarding 7.4 yet - then again its been about 4 hours and if there was a bad actor; it would be the ideal time to do so. Occams razor would actually suggest that the reason given for disconnects persists to be the reason; otherwise you need to make a assumption (the server cannot take it).

Also note we still see DC swarms on less populated server clusters yet do not see the same in JPN - I should have added that; as a frequent EU player myself we rarely see DCs and yet there are plenty of EU servers with greater populations then NA that are just as busy during there prime times - DC free - which is why I provide you ample context.

At this moment the EU servers have yet to be hit with DC's despite being (anecdotally) as busy as NA servers - likely more so as its not the middle of the work day. Your assuming that the majority of NA took the day off to play 7.4 which is why I think your making baseless assumptions (to match your tone about novel sized walls of speculation).

[NegativeS]

yap

A. An unspecified bad actor is apparently so spiteful toward specifically SQEX that they have had the game under a perpetual state of DDOSing since some random point over a year ago, even during content downtimes and hiatuses, which at best causes latency during low load and at worst makes it difficult to stay connected to the server. This mystery DDOSer is either wasting large amounts of money paying a bot farm or risking the integrity of their own bot farm with perpetual focused use. They have somehow continuously been able to evade every single countermeasure SQEX and their server hosts have put in place.

B. Parts of SQEX's server infrastructure is old or compromised, causing large amounts of people to randomly drop connection simultaneously whenever the server is under load. SQEX is either incapable of fixing it or are too apathetic to since money is still coming in either way. They're outwardly calling it a DDOS to get investors off their ass, and like everything else in modern FFXIV nothing will change while people are still paying their subs.

Until someone has proof that some shadowy cabal of bot farm hosts is determined to bring down FFXIV, I'm gonna stick with B. Do not attribute to malice what can be explained by incompetence.

[YumieYumiki]

Also note we still see DC swarms on less populated server clusters yet do not see the same in JPN - I should have added that; as a frequent EU player myself we rarely see DCs and yet there are plenty of EU servers with greater populations then NA that are just as busy during there prime times - DC free - which is why I provide you ample context.

At this moment the EU servers have yet to be hit with DC's despite being (anecdotally) as busy as NA servers - likely more so as its not the middle of the work day. Your assuming that the majority of NA took the day off to play 7.4 which is why I think your making baseless assumptions (to match your tone about novel sized walls of speculation).

The us have 4 logical data centers and the eu only two, so any comparison between the two are going to be apple versus oranges (not to mention that they are located in different parts
of the world, different telecom networks and so on)

I just dont like that people assume that from now on servers disconnects are ddos attacks by default and eager to brandish it as an excuse on behalf of SE.

The healthy reaction is: if the service is not working, by default the culprit should be assumed to be the service provider. They are big boys, if it is actually not their fault they can tell us themselves.