Anti-DDoS too aggressive, shaping my traffic to less than 70mb/sec ( on 7 servers.. )

[FrancescoV]

I run some webservers which serve small javascript files ( which are web widgets of about 8kb ) , I have several servers moved on ovh where I also have other services ( I also use their cdn service which is not bad )
the problem is that those servers trigger the anti DDoS service which WRONGLY think that legitimate traffic is an attack, put the server under filtering and I loose about 30% of the traffic… my clients are complaining , my internal statistics show also evidence of the problem since I’ve moved on ovh, when ovh remove the filter immediately the widget success rate increase from 70% to about 99%
( I can only see that in http 200-response and in client-recordered metrics ) the problem is that severs that should handle 500Mbps of traffic are “limited” to less than 70Mbps due to that filter… ( also with server resources ( cpu/ram usage under 30% ) )

I know that serving 8kb/request at 70Mbps is quite a lot, each server receive about 3000 connections/second which for a normal website could look like a DDoS , but for me It’s normal traffic!

I know what I’m talking about because I was serving same widgets on softlayer since a month ago with 1/4 of the ram per server and 1/2 of the servers ( and the have a DDoS too but probably less aggressively configured )

I don’t even know if I can order multiple very small servers instead of less big servers to workaround that issue because OVH don’t want to tell me the DDoS threshold that is hitting me ( Packet per seconds ? ip / seconds ? conntrack ? what ? ) are thresholds equals for all servers ? there is no documentation.

the not so funny part of all that is…
I’ve already opened a ticket for that… 6528169741 , and in 9 days I have yet to reach a tech, on day one a “tech” from italy team asked me a tcpdump which I provided in MINUTES , then silence for days, after a call the tech told me that the dump was too big… ( about 100mb ) , I asked which size would be better for them and he told me about 3mb, I said ok , but you could have truncated the tcpdump yourself with the tcpdump command to the size you want… anyway I’ve uploaded immediately a new tcpdump of 3mb, no reply for more days…
after 6 days of ticket… another italian “tech” told me that have opened an internal ticket… after 3 days I’m still waiting… not knowing a lot of things :

• If the problem can be fixed ( DDoS thresholds adjusted )
• how to handle such cases in future ( having to fight with “tech” support for days to get a reply is not my work ) /new servers

[Lee914]

I am in the same boat as Francesco. I have an OVH server with 2Gbps dedicated/unmetered option. I noticed that it is only outputting 600 mbps. I reached out to OVH support (Ticket #9684419494) but it’s been days and no resolution came out of it. Still waiting, though.

But if DDoS protection turns out to be the cause of this shaping then I don’t think the service is worth it and I will probably cancel the server to get a cheaper 1Gbps option.

On a side note, OVH seriously needs to step its game up in the control panel and support department. They should seriously sit down and learn from the likes of Digital Ocean, Vultr, even Hetzner. Turns out that the OVH Rescue Mode does not work with servers that have customized partitions – it’s that bad, yes

Oh well, good luck to us all.

[VianE]

I was really looking into OVH for Ddos protection, but looks like that’s not working out for people here. And judging from the forum OVH will not help you if you need support.

[DannyC]

Hi,

You after remember when OVH open internal ticket they contact the Anti-Dos Teams. They will look at your packets they will check on the VAC systems see if they are able to change or put custom profile in place. This will take number of days some-times weeks sometimes they after contact outside of OVH or contact CISCO

[DannyC]

The OVH anti-ddos the best on the market no where else you’re going get the best OVH anti dos system i was beta testing it when first was launched over the many years loads improvements have been made and if something wrong with the anti-dos system will be on it right away check this out.

http://travaux.ovh.net/?project=24&status=all&perpage=50