I opened a support ticket with dialtone stating to them that there is a fragmented attack coming into one of my servers and it was originating from a server within their own network.

The response that i got was:

I have investagate this issue and this ticket will be eslcated to a abuse department. He will respond to you during business hour 9:00 A.M to 5:00 P.M Eastern time.

So basically they didnt do anything and the attack marches on...

Wouldnt you think they would really find out were it is coming from especially if it is within their own network instead of waiting until tomorrow?

you betcha that if i were them i would hop on it, what a nightmare. one of your servers in ur network packeting the hell outta another serv...on the same network.

if they think i am going to pay for th extra bandwidth they got another thing coming...

hehe, if they ask u to pay for bandwidth, pay them, then sue em for not fixing the prob

as of 11 AM it is still going on.

Since it's still happening, may I suggest downloading "iftop" it will show you all incoming and outgoing connections on the interface. You can then see exactly what IP it's coming from and see the size. Then you can run some calculations and ask then to credit you ;-)...

I know exactly where it is coming from:

10:57:32.264064 64.239.50.208 > 224.2.145.242: (frag 62649:191@1480)
10:57:32.265297 64.239.50.208.4566 > 224.2.135.140.29999: udp 1663 (frag 62650:1480@0+)
10:57:32.265496 64.239.50.208 > 224.2.135.140: (frag 62650:191@1480)
10:57:32.266729 64.239.50.208.4847 > 224.2.145.242.21011: udp 1663 (frag 62651:1480@0+)
10:57:32.266952 64.239.50.208 > 224.2.145.242: (frag 62651:191@1480)

Also I have noticed their support is much slower than what it used to be. I have used them for about 2 years now, but for the last 10 months or so i never opened a ticket. Before they would work on a problem asap, but now it is taking them several hours to respond and the problem above is going on for days...I wonder if i click on their little button that says "i preauthorize charges" if i would get a quicker response.

I guess when they inserted the "interland" into dialtone - interland, they must have also inherited slow support.

Another day has gone by and no action taken by dialtone.

Originally posted by goodness0001
Another day has gone by and no action taken by dialtone.

thats crazy can you not call them?

Another day and nothing is giong on, it is pushing about 6-10 Mbit

Day 4 and still nothing.

Why not call? Or atleast shut the server down.

I have had several responses from them tell me everything but the solution. I have told them to shutdown or unplug that other server, but they they refuse to take the easy solution and then they try to sell me firewalls and all this other crap...except solving it.

Day 4 was the trick, i got a straight answer and solution.

Originally posted by goodness0001
The response that i got was:

I have investagate this issue and this ticket will be eslcated to a abuse department. He will respond to you during business hour 9:00 A.M to 5:00 P.M Eastern time.

So basically they didnt do anything and the attack marches on...



Apart from the ticket directed for 'Abuse', open another ticket under 'Network Problems', state your problem and flag the 'authorized charges' tickbox. Hopefully they'll respond faster. Remember this is not a problem of your server, it's a problem coming from another server on their network so you won't be charged for this.

Sounds like the days of Great Dialtone support are going bye bye, now come crappy support from Interland, you know they are priming us up. You know its "Dialtone Interland" now.

When the support gets even worse it will then just be Interland.

:rolleyes:

I must add that their front line support does have some problems. They're getting very lazy nowadays. I recently had some very serious problems and they tend to take their own sweet time (2 days) in resolving the issue but once I say I'm going to 'escalate the problem to a higher level' they get it resolved like lightning... Makes me wonder???

I'll have to add my 2 cents...

I've been with Dialtone for almost 2 years, and the past month has been HELL. I've had VERY VERY VERY slow and inadequate support responses. I have an issue that is 4 weeks old. It was a complicated issue, but it should not have taken more than 2 weeks to resolve--AT THE MOST!!!! I couldn't find the right people to complain to. I finally got some response today from the 'escalation people', but I still don't think this is going to turn out very good for me. They just don't pay attention to detail and make careless mistakes. A lot of the damage has already been done. I am starting to wonder if I should quit while I am ahead (or behind!!) and switch to another company right away.

I went to their CTO which is 1 step away from the CEO in their escalation. I first went to the support supervisor, and he farmed it out to some other tech that didnt give me any answers, so today i emailed the CTO. He replied promptly and called me on the phone and he explained to me that someone on the same vlan as me is doing some sort of multi-casting broadcast which broadcasts traffic to all the servers in the vlan for some sort of realtime processing going on that one server, but he said they subtract all this traffic out of our bandwidth reports...i dunno, it just doesnt sound 100% right to me, but then again im not a network guy. It just seems like a lot of wasted resources to be broadcasting traffic to all the servers on a vlan if they arent intended on receiving it.


edit: spelling

I'm glad yours is finally resolved. It should not have taken an escalation to get that answer, though. I had escalated my issue to CTO about 2-3 weeks ago, and it went to one of the techs who had worked on the issue. He blew it off. Then I tried contacting some other people over the past few weeks. It would look like I was going to get this thing over with and then I would run into another problem. I finally sent it to CTO again and CEO today and got more attention. Still, it's not resolved and it's been 4 weeks since I opened my ticket. I have an offer from rackspace that I'm considering now. :)

As for that bandwidth stuff... it sounds fishy. I don't entirely trust them when it comes to bandwidth. How do you know if they subtract it out?

The whole point about DI servers is that you will do alot better if you have some semblence of sysadmin skills - I guess this guy didn't so he didn't take some pretty fundamental steps to block the attack

With any server, you would do better with sysadmin skills. I think the whole point is that Dialtone is trying to live up to a 'managed hosting' label, but they can't. They don't follow through. I don't have to use support very often (maybe 2-3 times in 2 years for something I couldn't do myself), but when I do I expect it to be done right. If the skill to block the attack is fundamental, then the tech should have solved the problem the first day.

Originally posted by DaveC#
The whole point about DI servers is that you will do alot better if you have some semblence of sysadmin skills - I guess this guy didn't so he didn't take some pretty fundamental steps to block the attack

Bulls-h-i-t i didnt take any fundamental steps to block it, i implimented several new Iptables entries, blocked the ip and range, dropped all udp traffic...nothing worked. I then consulted dialtone and none of their iptable entries worked either. Dont assume because it makes an ass out of you.

The whole point about DI servers is that you will do alot better if you have some semblence of sysadmin skills
If they're going to offer so little support as to not protect their own network from this type of abuse, then you would be better off getting a server from RackShack and using all the money you would save to hire your own sysadmin for a few hours a month (or pay for your own time). If I was going to pay Dialtone's prices, I would expect some level of support, at least in case of an attack where it is in their court to really help (investigate the other server which is on their own network, help block at the router, etc.) If Dialtone is going to be equally or more slow to react, at least with RackShack you get a lot more bandwidth for free for the attack to chew up before they step on it.

Hello;

I have a feeling i can add some input and light on this issue.

I run a webhosting compnay out of dialtone colo. The company consists of 2 partners and I. All 3 of us are previous level 2 techs at dialtone. I left first about 2.5 years ago, another partner left 1.5years ago, and the third partner just left 5 or so days ago.

One thing that dialtone has not anticipated was the growth in servers. When i was at dialtone, DI managed about 1800 servers. Today, not counting Interland servers, it is managing almost 8000 servers. Ontop of this, in the next 2-3months, they will be moving all of these servers to the new location in Miami, FL....aka innerhost. I truely dont know how they can do it in the open window of 2hours per server once a month but they fell they can do it....keep in mind the drive is 1hour on its own....so a nice question is..... is it possible to remove a full rack of servers, stretch wrap it, bubble wrap it, fill a truck full of racks, drive to the new location, unload, unpack, and finally put back online in 2 hours...... hmmmmmm i dont think so....but they will try.

One thing i do admit is that i feel that once they move to the new location, they will have much better noc and support if you want my personal opinion cause the number of support personal is going to be doubled... Currently DI's support is based on 4 teams... Each team has a monitor that either blinks Green, RED, and purple. red means that their is a urgent ticket and billable... purple means that their are more than one urgent ticket. green means that their are regular tickets. i forgot to mention that each of these have a number associated to them.... We where always told to work on emergencies first and then others...

I can go on for ever cause i visit DI on a weekly basis practically cause of other friends there.... and my past experience.

If you currently host your server at DI, and have been their for the past 3 years, i say thank you for giving me the experience i have today.

You can visit my site at
http://www.biznesshosting.com

we deal with webhosting and dedicated / colo servers.....

although the current design is kinda shabi, we are working on something that should really rock....