# The Techno-Peasant is Puzzled: What is a Denial of Service attack, please? **URL:** \ **Category:** Factual Questions\ **Created:** [April 23, 2016, 1:19am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856 "2016-04-23T01:19:49Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![ThelmaLou](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thelmalou/32/390_2.png) [@ThelmaLou](https://boards.straightdope.com/u/ThelmaLou)\ **Post date:** [April 23, 2016, 3:43am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/21 "2016-04-23T03:43:32Z")
I don’t know if anyone else noticed this (I do a lot of proofreading and editing), but the “you’ve used up your login attempts” message that everyone was getting during the outage was formatted differently from the regular, legitimate “you’ve used up, etc.” message. I got the real one today when I accidentally entered my password wrong. The bogus message had bolded text in it. The legitimate message does not. Which suggests that the login attempts did not trigger the legitimate warning message, but one composed by the hackers. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [April 23, 2016, 3:50am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/22 "2016-04-23T03:50:34Z")
> [@Crazyhorse](#): > > Under a DDoS attack the first and really only symptom to the outside world is that pages take forever to load if they load at all. That’s certainly true for the typical DoS attack, but it doesn’t have to be true. Traffic floods just happen to be the easiest and most common way to achieve a DoS. Repeated bad logins also deny service to the users, but wouldn’t necessarily make the site impossible to contact. There are lots of ways to interfere with the operation of a service. ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [April 23, 2016, 3:58am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/23 "2016-04-23T03:58:48Z")
> [@Dr.Strangelove](#): > > That’s certainly true for the typical DoS attack, but it doesn’t have to be true. Traffic floods just happen to be the easiest and most common way to achieve a DoS. Repeated bad logins also deny service to the users, but wouldn’t necessarily make the site impossible to contact. There are lots of ways to interfere with the operation of a service. As I said I assume there is good evidence that indicates it was a DDoS that we just don’t know about - but not in a way, at least I don’t think, that someone tried to log us all in repeatedly using our actual login names. It appears we were all being routed to the SDMB under the same IP address, and that is what triggered the login refusals. The error message we got is just kind of misleading and poorly worded. I think it was really saying that too many login attempts had come from the IP address 10.24.35.2, and to wait 15 minutes, and it had nothing to do with the actual username attempted. ---
**Author:** ![Ranger\_Jeff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ranger_jeff/32/2065_2.png) [@Ranger\_Jeff](https://boards.straightdope.com/u/Ranger_Jeff)\ **Post date:** [April 23, 2016, 3:59am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/24 "2016-04-23T03:59:55Z")
Eh. Once I got back in, I went to the user control panel and edited my password. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 23, 2016, 4:58am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/25 "2016-04-23T04:58:37Z")
Except that the entire board _was_ down. There was a span of time there where any attempt to do anything on the board, even read the forum list, just timed out. It was only after that resolved itself that I was able to even attempt to log in. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [April 23, 2016, 5:39am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/26 "2016-04-23T05:39:01Z")
Maybe _everybody_ was getting that too-many-fails message, even all the mods and admins and even Ed. What happens if _nobody_, not even TPTB, can log in? Then how do they fix that? Time to dig up the old back-up tapes? ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [April 23, 2016, 6:05am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/27 "2016-04-23T06:05:04Z")
An unresponsive site would also be consistent with an issue with the load balancing or internal routing. A screwup in that does sound like a plausible scenario. Annoyingly the board won’t keep me logged in at the moment making it rather painful to use. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 23, 2016, 12:42pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/28 "2016-04-23T12:42:17Z")
Not everyone was getting the failed-login messages: A few folks were managing to post, using their established accounts, while the rest of us were shut out. I believe, though, that all of the mods and admins were among the shut-outs. If true, this lends some credence to the deliberate-attack hypothesis: An accident would presumably shut out accounts at random, while an attacker would certainly make sure that the board leadership was among those shut out. I’m not sure what the proportion was of people who were able to stay on, though, nor if there were any other patterns such as in amount of activity (moderators tend to be from the more active segment of users). So even if all of the mods were shut out, it’s unclear just how strong evidence that was. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [April 23, 2016, 12:55pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/29 "2016-04-23T12:55:58Z")
> [@Chronos](#): > > Not everyone was getting the failed-login messages: A few folks were managing to post, using their established accounts, while the rest of us were shut out. Who (other than new sock accounts) managed to post? I don’t recall any such posts, or at least they didn’t show on the main page as new posts after about (IIRC) 8:36PM Thursday Chicago time. Unless you are talking about the pre-main-outage time frame. It looks like the board was flaky; up and down for a few hours before it went down totally. ---
**Author:** ![Baron\_Greenback](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/baron_greenback/32/48_2.png) [@Baron\_Greenback](https://boards.straightdope.com/u/Baron_Greenback)\ **Post date:** [April 23, 2016, 1:30pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/30 "2016-04-23T13:30:02Z")
> [@Musicat](#): > > Who (other than new sock accounts) managed to post? I don’t recall any such posts, or at least they didn’t show on the main page as new posts after about (IIRC) 8:36PM Thursday Chicago time. Giles made a few increasingly plaintive and lonely posts. It seemed like he was the only one still logged on for a few hours. > **[SDMB just down?](https://boards.straightdope.com/sdmb/showthread.php?t=791055)** > > Was the SDMB just down for 3 to 4 hours? It seems to be working normally now. ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [April 23, 2016, 1:58pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/31 "2016-04-23T13:58:11Z")
[ul] [li]My guess[/li][li]I’m not really certain.[/li][li]Nobody currently knows who is responsible[/li][li]Knows for sure, at least,[/li][li]Lot’s of guesses.[/li][li]Everyone has ideas.[/li][li]Rule out some, plenty more pop up .[/li][/ul] ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [April 23, 2016, 2:03pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/32 "2016-04-23T14:03:51Z")
> [@Baron\_Greenback](#): > > Giles made a few increasingly plaintive and lonely posts. It seemed like he was the only one still logged on for a few hours. > > [SDMB just down? - About This Message Board - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=791055) I thought that maybe there was a sooper-sekrit Australian ISP that the bad guys hadn’t managed to block. ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [April 23, 2016, 2:10pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/33 "2016-04-23T14:10:14Z")
Possible causes for Prince’s death currently include: > [@kayaker](#): > > [ul] > [li]My guess[/li][li]I’m not really certain.[/li][li]Nobody currently knows who is responsible[/li][li]Knows for sure, at least,[/li][li]Lot’s of guesses.[/li][li]Everyone has ideas.[/li][li]Rule out some, plenty more pop up .[/li][/ul] ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [April 23, 2016, 2:41pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/34 "2016-04-23T14:41:05Z")
And then, once **Ed** and **Engineer\_Comp\_geek** realised that **Giles** was inside, they sent him a PM with the secret code to turn off the SDMB shields. After **Giles** heroically managed to fight his way to the internal controls, enter the secret code, and turn off the shields, **Asimovian** , **Ivory Tower Denizen** and **RickJay** led the assault and defeated the DDoS Storm Troopers. Once inside, acting on instructions from **Admiral Colibri** , they re-installed the proper hologramic codes, and the SDMB was restored to action! At least, I think that’s a better explanation for what happened than all that technical computer stuff you guys are talking about. 🙂 ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [April 23, 2016, 2:43pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/35 "2016-04-23T14:43:01Z")
It’s all speculation anyway, we don’t have all the details to diagnose this. Root cause analyses are generally a waste of time anyway because the admin that screwed things up won’t admit to what they did. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [April 23, 2016, 2:58pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/36 "2016-04-23T14:58:09Z")
Some points: -Locking all the accounts is a denial of service attack - it’s just a different one that what is usually meant by a DDoS (which is the flood of traffic scenario). -Surely if they changed to a proxy and the board system saw only the proxy address - some administrator would have noticed fairly soon? I assume “same IP address” is one flag that a person is creating multiple sock puppets would trigger. If everyone is the same address… either the software automagically blocks everyone not long after the switch to proxy (hmmm) falsely identifying them as the same person wearing multiple guises, or the mods did not notice. (Does the error look different if your userid has been blocked than if your password count is exceeded?) -oddly, both my computers “forgot” my login over the last days and I’ve had to re-enter my credentials. I had initially blamed this on Windows 10 updates, I was not aware of a DDoS; Windows 10 browsing is messed up, so I am rarely surprised when odd things happen. I think my W10 install was deleting cookies each night with browsing history, or something “secure” like that until I told it to stop. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [April 23, 2016, 3:06pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/37 "2016-04-23T15:06:20Z")
> [@md2000](#): > > -Surely if they changed to a proxy and the board system saw only the proxy address - some administrator would have noticed fairly soon? I assume “same IP address” is one flag that a person is creating multiple sock puppets would trigger. If everyone is the same address… either the software automagically blocks everyone not long after the switch to proxy (hmmm) falsely identifying them as the same person wearing multiple guises, or the mods did not notice. That only works if such a function exists and is enabled. vB has many functions that can be turned on or off by admins. Some useful ones might have been turned off due to unwanted side effects. vB has several “flood detector” functions but it’s been a while since I admined a vB board, and I don’t know if this one is included. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [April 24, 2016, 3:37am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/38 "2016-04-24T03:37:28Z")
Another example might explain Denial of Service attacks. The happened even before PC’s. On landline telephones. I remember an incident in the 1970’s with a high school team that felt they had been treated unfairly by a business – they had everyone on the team & their friends dial that businesses phone during a specific hour. The flood of phone calls promptly overwhelmed the incoming lines on the switchboard, and began rolling over to other incoming phone lines, to other employees & salesmen. Soon every phone line was busy with a student ranting to an employee about the unfair conduct of their company, and any customer trying to call in got a busy signal. That was an older technology ‘denial of phone service’ to that company. The newer version is similar, using many PC’s to overwhelm a server so it’s too busy to answer legitimate requests for web pages. ---
**Author:** ![Cabin\_Fever\_1](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cabin_fever_1/32/2908_2.png) [@Cabin\_Fever\_1](https://boards.straightdope.com/u/Cabin_Fever_1)\ **Post date:** [April 25, 2016, 12:40am UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/39 "2016-04-25T00:40:57Z")
> [@Crazyhorse](#): > > This doesn’t appear to have been the case. I got the same message no matter what username I tried to log in with. I tried “Mickey Mouse”, “ABCDEFG”, etc. and got the exact same response as with my own actual username. I only received an email from the SDMB that someone tried to log in to my specific account after I did so myself too many times, but I was already receiving that error message with my or any other username from the first try. > > The error message was triggered because every login request to the SDMB server appears to have been coming from the same IP address, 10.24.35.2. It was a block on any login attempts coming from that IP address regardless of the username. That address is an internal-network-only address, probably used by some router or proxy on the network at the place that hosts the SDMB. > > A google search indicates this scenario has played out on many other vBulletin systems and in at least several cases it happened because their web host tried to do some kind of load balancing internally and caused all requests to the boards to come from a lone, internal IP address instead of the actual client’s address. > > I would assume TPTB here have some reasons we don’t know that indicate to them it was a DDoS attack, but from the outside it looks a lot more like the host who serves the SDMB just made some internal change to a proxy or load balancing system and accidentally caused all requests to the SDMB to come from the same internal IP address. As a former sysadmin, I think you might have nailed it. It is trivial to get internet info on SDMBs’ web host, IP address, et al. The 10.x.x.x block sort of points to that. Thanks to all that got the SDMB back up. I was going through some serious withdrawals there. ---
**Author:** ![Half\_Man\_Half\_Wit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/half_man_half_wit/32/21766_2.png) [@Half\_Man\_Half\_Wit](https://boards.straightdope.com/u/Half_Man_Half_Wit)\ **Post date:** [April 25, 2016, 5:17pm UTC](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856/40 "2016-04-25T17:17:21Z")
I can’t read this thread’s title without thinking it’s about some sort of Ren Faire version of [Techno Viking](https://en.wikipedia.org/wiki/Techno_Viking)… [Previous page](https://boards.straightdope.com/t/the-techno-peasant-is-puzzled-what-is-a-denial-of-service-attack-please/752856.md?page=1)