This is not a DDOS, Tell the truth SE.

[NightHour]

A DDOS in pretty much all scenarios is a consistent denial of service attack, if it were happening it would not be as inconsistent as this "DDOS" is.

Even with DDOS protection in place, it would still not be this inconsistent.

This is a server overload or server hardware issue, I'm not buying the excuse.

Please fix the actual problem.

Actually it is a DDoS .... BUT it's not an attack directed at XIV specifically.

IF XIV was being targeted directly then surely they'd hit all regions, not just NA, right?



Internet traffic travels through nodes usually ran by the hosting providers (NTT in this case) or the big internet exchanges like AWS, Cloudflare, Level3, Twelve99, Arelion etc.


It's a lot harder to DDoS one of the big internet exchanges as they invest millions into DDoS mitigation and protection, they have the resources to mitigate thousands of terabytes of DDoS traffic.




On the route to the XIV servers there is a problematic Node hosted by NTT in San Jose that keeps getting hit.

Because XIV routes through that node, the attacks against that node are having a knock on effect.


The only way things change is if they finally accept NTT is trash anywhere outside of Japan and changes hosting provider.

Either that or they massively upgrade their DDoS protection plan, JP is protected by Akamai so I heard and isn't hit anywhere near as much as NA



EU Servers route through nodes run by Arelion aka Telia (TeliaSonera). No NTT San Jose node and we're fine.



I don't know why they can't just come out and say -

"Our current hosting provider isn't living up to standards of service we and our customers expect and we're exploring other options"




I don't know if they stay with NTT because it's cheap or whether they use NTT because they wanted to stick with a Japanese company but come on now.......


The fact JP is unaffected but NA is riddled with issues is a big eye opener that either NTT sucks ass outside of Japan or the DDoS protection plan they have for NA is insufficient.




Some NA players found that VPN's like Mudfish and Exitlag can change the route your traffic takes which reduces your disconnections...

[Themarvin]

A DDOS in pretty much all scenarios is a consistent denial of service attack, if it were happening it would not be as inconsistent as this "DDOS" is.

Even with DDOS protection in place, it would still not be this inconsistent.

This is a server overload or server hardware issue, I'm not buying the excuse.

Please fix the actual problem.

SquareEnix is a Foreign and successful company that also got servers in the USA.... a certain Orange person is more likely to be blamed for it, if anything, as anything successful in NA is apparently a bad thing.

And there you have it... we don't have the issues on the EU/JP DC and it is the same hardware pretty much.

[Jeeqbit]

Actually it is a DDoS .... BUT it's not an attack directed at XIV specifically.

The DDoS started 9 minutes after Savage released, and heavily disrupted everyone's progression in the NA region.

World First racers traveled to Materia (the OCE region) in order to avoid the DDoS attacks. Almost immediately, there was a DDoS attack on Materia in the Oceanic region.

And you think it's not targeted? This removed all doubt. It is very targeted. Considering it has affected WoW recently as well, perhaps the attacker does not like MMORPGs in general.

IF XIV was being targeted directly then surely they'd hit all regions, not just NA, right?

Maybe the other regions have better DDoS mitigation. Or maybe they just need to focus the attack somewhere and choose where. They obviously were capable of attacking Materia, but didn't do it before because nobody hardly plays on it.

It's a lot harder to DDoS one of the big internet exchanges as they invest millions into DDoS mitigation and protection, they have the resources to mitigate thousands of terabytes of DDoS traffic.

I emailed NTT myself and asked them to sort the general DDoS attacks on their nodes. Their response was from their security team, and they did not seem aware of a DDoS attack on their nodes otherwise they would probably have told me. They did, however, tell me that there can be DDoS targeted at specific organizations and that they have "DDoS mitigation services" that they can purchase.

They did not confirm nor deny whether Square Enix has purchased these DDoS mitigation services (obviously for privacy policy reasons), but I was able to find that NTT have several tiers of DDoS mitigation tools you can purchase allowing increased levels of packet analysis, filtering and configuration.

[ijuakos_xqwzts]

SquareEnix is a Foreign and successful company that also got servers in the USA.... a certain Orange person is more likely to be blamed for it, if anything, as anything successful in NA is apparently a bad thing.

And there you have it... we don't have the issues on the EU/JP DC and it is the same hardware pretty much.

There's a reason folks call it "derangement". This isn't Reddit, guy. That "certain Orange guy" has nothing to do with our problems here.

I just traced my route and the last node I can see an IP address for belongs to NTT. However, the geolocation on that IP was in Illinois. Is this the same one causing all of the problems? Or is it some other IP down the chain that's filtering out ICMP echo messages that I can't see? I would like to figure out if I need to switch to another node on my VPN to route around this problem.

[Jeeqbit]

I just traced my route and the last node I can see an IP address for belongs to NTT. However, the geolocation on that IP was in Illinois. Is this the same one causing all of the problems? Or is it some other IP down the chain that's filtering out ICMP echo messages that I can't see? I would like to figure out if I need to switch to another node on my VPN to route around this problem.

All I know is that when they filter suspected DDoS traffic it can be redirected.

"NTT DATA has globally deployed best-of-breed infrastructure with robust DDoS mitigation capabilities and sufficient capacity to combat large-scale attacks. When notified of a possible DDoS attack, our security experts analyze network data to confirm an attack is underway and then apply various countermeasures including the redirection of all traffic destined for the DDoS target through NTT DATA’s mitigation platform for scrubbing."

[Striker44]

The DDoS started 9 minutes after Savage released, and heavily disrupted everyone's progression in the NA region.

World First racers traveled to Materia (the OCE region) in order to avoid the DDoS attacks. Almost immediately, there was a DDoS attack on Materia in the Oceanic region.

And you think it's not targeted? This removed all doubt.

Doesn't remove all doubt for me, yet, because of the simple possibility that it can be both things. 99% of the time, it could be a non-targeted attack on the NTT node. The other 1% of the time (aka when Savage released), malicious actors who do want to target FFXIV and are already clearly aware of the weak point (NTT node) do their thing. Wouldn't change that they have nothing to do with it the rest of the time. There can be multiple malicious actors with different motivations involved.

[NightHour]

The DDoS started 9 minutes after Savage released, and heavily disrupted everyone's progression in the NA region.

World First racers traveled to Materia (the OCE region) in order to avoid the DDoS attacks. Almost immediately, there was a DDoS attack on Materia in the Oceanic region.

And you think it's not targeted? This removed all doubt. It is very targeted. Considering it has affected WoW recently as well, perhaps the attacker does not like MMORPGs in general.
Maybe the other regions have better DDoS mitigation. Or maybe they just need to focus the attack somewhere and choose where. They obviously were capable of attacking Materia, but didn't do it before because nobody hardly plays on it.
I emailed NTT myself and asked them to sort the general DDoS attacks on their nodes. Their response was from their security team, and they did not seem aware of a DDoS attack on their nodes otherwise they would probably have told me. They did, however, tell me that there can be DDoS targeted at specific organizations and that they have "DDoS mitigation services" that they can purchase.

They did not confirm nor deny whether Square Enix has purchased these DDoS mitigation services (obviously for privacy policy reasons), but I was able to find that NTT have several tiers of DDoS mitigation tools you can purchase allowing increased levels of packet analysis, filtering and configuration.

If it was targeted, why hit 1 region?

Why not hit multiple or all?


Half assed DDoS if it was targeted tbh.


I ran a traceroute to OCE dc... guess what came up...


NTT.

[Jeeqbit]

If it was targeted, why hit 1 region?

They hit 2 as I said.

Why not hit multiple or all?

If you were in control of an army, would you split the army and attack 4 countries, or send them all to attack one country?

The risk of splitting the army is that the attacks on the 4 countries are weaker than if they all focus on one country. Same logic for a DDoS attacker.

I ran a traceroute to OCE dc... guess what came up... NTT.

Just yet another reason why they are hitting 1 region instead of all of them. It's probably the weakest target.

[Vrankyl]

If it was targeted, why hit 1 region?

Why not hit multiple or all?

One easy reason is that it is easier to target NA because the NTT nodes are so terrible it doesn't take much to cause them to start failing. And there's all sorts of reasons. Could be a JPN person not liking the NA playerbase because they are convinced SE listen to us more just as much as we are convinced of the reverse. Hell this most recent one could have even been a JPN raider wanting to ensure JPN won the race. Let's be honest, the JPN teams keep getting caught cheating so I wouldn't actually be shocked if they did this too.

[Deejudanne]

What i find extremely funny that doesn't even make any sense is that if it was DDOS then using a vpn wouldnt help at all