Tony

It was two unrelated attacks. One was at a reseller and another one was at one of our shared IP's. Obviously an attacker if they were targeting us specifically would have hit strictly our shared IP's not some random reseller IP in another range. We're keeping an eye on things though

It can eat a lot of connections but 100,000 or more is when you run into problems. So we have the system set to 100,000 connections (kernel setting) and the malicious user is using more than that. Well the kernel starts dropping connections unless we either do one of the following Increase connection limits Drop the bad connections The problem with 1. is with that many connections the CPU usage from it starts to be substantial. With number 2 well you need to design your dropping based on the types of connections. So we did that on Venus and Titan when we figured out the attack. We also used the Cisco Guard on both so we did not have to be doing this sort of filtering.

Guard protection has been removed at this point as the attack has stopped.

It's guard protected now and we'll leave this open until the guard protection is removed.

The attack has stopped for the time being and we're going to cisco guard protect the IP for probably 12 hours minimum to be on the safe side.

We've null routed the IP being attacked as the cisco guard did not automatically come on.

Titan has come under DDOS. We are currently working on the issue further updates will follow.

We will be migrating the accounts on the Mars server starting on Friday October 23rd and this will last until Tuesday October 27th. The reason for this upgrade is our continued commitment to having exceptional quality of service. The Mars server is showing it's age in specification so we feel everyone would benefit from a much needed upgrade. For the migration process we will be moving accounts in sections based on IP address. We anticipate no more than 5 minutes of down time per account in order to make the switch. We migrate the account data then re-route the IP address to the new server. Thus there is no down time associated with the upgrade. The time frame given we estimate will not be nearly this long. In the past we have migrated to other hardware without any down time in less than three days. So our 4 days just gives us plenty of time to do it right and make sure there is no interruption in service. The specifications of the server will be similar to that of the Skyline & Skyline servers that received their upgrades recently. Old Mars: Xeon 5430 4GB RAM 4x250GB SATA II Raid-10 New Mars: Dual Xeon 54xx 12GB RAM 4x300GB SAS Raid-10 You'll notice three times as much memory and SAS drives which are significantly faster than the SATA counterparts. The CPU's is still something that is up in the air at this point. It's subject to availability but it'll be at least Dual 5430 so the new machine will have twice as many CPU cores. If you have any concerns about this migration please do not hesitate to contact us. Start Date: 10/23/2009 End Date: 10/27/2009 Estimated Down Time: less than 5 minutes Duration: 4 days

All the links to TWC have been shutoff to solve this issue. It affected any ISP who was peering with them and may have came into the datacenter via that link. Latency might be higher for some users but things are accessible for all users now.

What you experienced is exactly what you'd expect. We do not open up the mongrel ports to be accessible. Could expose things you would not like exposed plus we don't know just how many ruby apps one server would see. So we'd have to open up a good chunk of ports to cover it. Since you wouldn't want people accessing via the port makes sense to just have the rewrite rule handle it.

Once it does the ports in cPanel you add a rewrite to make it accessible for web pages since each mongrel process runs their own port. cPanel should have the option right on the Ruby page.

Brian linked to me to this video made me laugh http://www.youtube.com/watch?v=On1drhgxGWU

As explained in the ticket your address does not match what your credit card claims it is. We simply do a AVS check which your card keeps failing so we cannot accept the charge. Our merchant is very strict if AVS is supported it must match so if it was not they cancel the authorization on your card. Here's more info about the AVS system: http://en.wikipedia.org/wiki/Address_Verification_System

What's everyones sleeping schedule look like these days? Mine is odd to say the least lately I've been going to sleep at 3-4am and waking up at 11-noon every single day. I had to do this for a few weeks and for about a month now every attempt to fix it does not work. I toss and turn and end up not falling asleep early then I ignore my alarm and sleep until noon. I might be the only one though. If you have to go to an office 9-5 you probably have a sane sleeping schedule

SEO hosting is not something we can offer. We give the choice of locations on our order form and we have a lot of servers but a single hosting account that can pick and choose is not possible.

Interesting the product group was not hidden for some weird reason. It's hidden once again since those prices are not reflective of what we can offer anymore.

It's not possible for us to transfer OS images to a dedicated server so you'd need to transfer the data yourself. Also any dedicated servers we offer are substantially expensive we do not offer low end machines. We deal strictly with highend so Dual Xeon 5520, 12GB ram, 4x300GB SAS 15K Raid-10 for example. We do not deal with a single Opteron 170 with 2GB ram and a 250GB SATA drive.

Speed issues for something like that is probably a network problem of some kind rather than a resource issue. So there is a routing issue between you and the datacenter causing slow downs. I'd test this by downloading our test downloads from each location: http://www.hawkhost.com/Network/index . I bet the slowest one is the one your VPS is in which would confirm some sort of routing issue.

I believe you made a ticket. Just turns out on skyline a lot of people were using IMAP so we had to increase the number of connections.

This has now been completed. If you have any problems please contact support.

90% complete at this point.

Windows hosting would be targeting people wishing to use ASP.NET, SQL Server as well as the ability to use a mail system similar to exchange. As far as java the problem with it is having the underlying software supporting it. It's no good if we're having to manually setup everything for users. We're all about automation.

The new drive has finished rebuilding and the raid array is now optimal once again.

We're about 50% complete the migration but this is based off of number of accounts. We could very well be entirely finished by tonight or at the latest tomorrow at some point. Some groups are migrated faster than others so saying 50% completed does not mean it'll take the same amount of time for the last 50%

The drive has now been replaced. Just a further note we did not just replace the raid card but also the cabling as well. It's just a normal measure taken with anything to do with the raid cards. We always replace anything that could potentially have caused issues.