This is not a DDOS, Tell the truth SE.

[BlisteringFrost]

"Square Enix has little control."

Yes. The only game where this regularly happens for multiple years long now.

Not how that works. Read at LEAST just one page back lol

[CNitsah]

Facts in support of DDOS:
Facts in support of server overload:
- FFXIV is still the world's most popular MMO with over 30 million players (WoW, in comparison, only has around 3 million). We know that Square Enix did not anticipate FFXIV being this popular.

In which fantasy are you living. WoW is still n°1 by far. and XIV does not have 30 millions players. Maybe created character, even maybe 30 millions account created since 1.0. But the player count is estimated between 1 and 2 millions actives players.

WoW is around 3 million active players.

[UkcsAlias]

Yes. The only game where this regularly happens for multiple years long now.

Sony has a big ddos on their PSN fairly often, which is a significantly larger platform and affects a lot more games.

Valve had team fortress 2's matchmaking being unplayable due to cheating bots for over 6 months straight. No mitigations were taken for a very long time. The only reason it didnt die was because private servers were still a thing there.

Each game has their own problems, and especialy if you have to maintain the servers yourself, and its a game with a lower player count than the top tier games, you are vulnerable to this. Mitigation hardware isnt cheap and has a constant cost going on (you usualy hire this). At expansion releases you know loads will be higher, and ddosses being more likely, so you prepare ahead of time, but this is like a random time, making it almost unpredictable when it would happen. And if they made it severe enough, you cant mitigate against it quickly.

SE only has control if these servers have overlap with many games, as the more the server needs to do, the higher its investment into protecting it against attacks. DT made a big dent in the player base in popularity, which means either massively overpaying for capacity you dont need, but being ddos protected, or reducing costs and hire the mitigations when the ddos happens. You can be sure which one management prefers 99% of the time.

There is no middle ground, as either a ddos is strong enough, or it isnt. If it is too strong, then you need those mitigations, otherwise you dont. Any extra capacity beyond preventing the ddos is like it doesnt exist, a huge cost sink. And im not sure if that cost sink is worth it to pay extra for.

[RaideDuku]

The nightmare corpse-city of R'lyeh has been unsealed. Cthulhu stirs from his dark slumber. All of creation shall tremble and weep. Reality and sanity as we know it shall cease to exist. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn!

...

This may also cause intermittent connection issues with Final Fantasy XIV. An extremely specific and odd side effect. Cthulhu apologizes for any inconvenience and hopes you can find some other flitting inconsequential distraction so he may continue his dark works unnoticed and unabated.

[MicahZerrshia]

WoW is around 3 million active players.

9 million actually according to recent, seemingly official, leaks and XIV is likely not even hitting a full 1 million from what we can deduce from the numbers we have

[cutestfox]

This is a server overload or server hardware issue, I'm not buying the excuse.

Oh is this why the servers can't sustain us?
Unexpected player gain

[MisterNublet]

If its not DDoS attacks, it's NTT being an absolute dog's arse of a ISP.

[Catwho]

If its not DDoS attacks, it's NTT being an absolute dog's arse of a ISP.

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

[Shipp]

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

The boots haven't knocked me offline once. It leads me to believe it is an attack on one of the ISP nodes instead of the servers themselves. I've maintained connection every single mass DC.

[TaleraRistain]

Usually when it's an NTT node acting up (looking at you, San Jose) it only impacts certain ISPs. For about six months a few years ago Charter/Spectrum had massive problems with that node, then suddenly one day they resolved.

This is instead a direct blast on the data center that hosts XIV, knocking the instance servers offline specifically. The lobby servers are actually okay. If you get a 9002 and wait about 30-60 seconds before attempting to reconnect, you can get back in without the 2002 (which happens if you try to reconnect too fast.)

These narrow, specific crashes mean it's either:
1. A DDoS attack targeting the instance servers specifically OR

2. The actual data center hardware for the instance server is dying, like a bad switch or something.

If the latter was true, they'd get the blinky lights notifying them of the problem right away and it's easy to do a hardware swap. Commercial hardware warranties are 5 years, so its not a matter of money if a thing dies early.

For me, that rules out #2.

Yep and AT&T was affected by that node for some time when our turn came around and Verizon experienced it. It hits certain ISPs at different times. And then just clears up one day. There's a huge thread about it on the tech forums.

That node is notorious but usually causes massive lag and not constant disconnects. Constant disconnects are usually DDoS. And you're right about the lobby servers. If you give it a second before trying to go back in you can usually get by without the lobby server crashing on you.