DDOS, Overnet & Routers (Overnet kills my router)

**RJ5500** · February 2nd, 2004, 01:07 PM

So, I have given up using Overnet for the time being, and maybe permanently. Here's the background to this problem.

Back a few weeks ago when I first got broadband & a router, I started using Overnet. I thought I download and uploading fine, but every now and then I'd notice that my whole internet connection would be dropped.

I mean, it would be totally dead. I couldn't even access my cable modem diagnostics page through my web browser. I did not suspect Overnet then.

I managed to get my connect eventually working again by unplugging/resetting both devices (the router and cable modem) and un/re plugging my ethernet cables into the devices.

I continued to use overnet thinking the "outage" was just something with my ISP. The connection dropping happened again and again. Often several times a week. This just kept happening.

Just late last week, in an effort to get to the root of the problem I noticed that every time this mysterious "connection drop" occured, I was running overnet.

I sometimes wasn't all the way present when this connection drop occured because I would leave Overnet running at night and wake up in the morning to a night of nothing transfered (and the tip off was no one was uploading partials from me).

I knew it had to be a router issue because during one of these "outages", my whole wireless network throughout my house was down (no signal detectd from my laptop). I knew the router was partially working because I could still ping my local machine at 192.168.0.100 and it would send back data. That meant that the DHCP of my router was still functioning. I just couldn't reach the outside internet.

I stopped using Overnet a few days ago and my connection has been running flawlessly since 24/7.

Was it a coincidence that the connection drops stopped when I stopped using overnet? Maybe, but I don't believe in many coincidences.

What could have caused this? I am not entirely sure. My belief is that somehow overnet was DOSing my connection and it was somehow getting way overloaded.

Kind of like how SCO's website was brought down (amoung others).

**warez-wolph** · February 2nd, 2004, 01:14 PM

If you're using Zone alarm for a firewall it intefers with overnet and will kill your internet connection

**RJ5500** · February 2nd, 2004, 01:17 PM

Originally Posted by warez-wolph

If you're using Zone alarm for a firewall it intefers with overnet and will kill your internet connection

Well, originally (back a few weeks ago), I was using Zone Alarm.

But last week I changed OS's and don't even use Zone Alarm and still happened.

**zaphodiv** · February 2nd, 2004, 01:47 PM

What brand and model of router is it?

Check the manufacturers website for a firmware update.

I'v seen this problem with netgear routers, the newest firmware is an improvement but it still seems to happen ocasionally so I won't be buying netgear equipment in future.

Routers should not crash when handing heavy traffic.
If a firmware update dosn't fix it then it's faulty, return it for a refund or exchange it for a different model.

**Sephiroth** · February 2nd, 2004, 02:09 PM

Originally Posted by RJ5500

What could have caused this? I am not entirely sure. My belief is that somehow overnet was DOSing my connection and it was somehow getting way overloaded.

Im pretty sure Overnet uses UDP packets. UDP has no flow control and can DOS peers on the network offline because there is no way to control the flow of packets to hosts.

Other than not running it as a server, which if it still happens the only thing you can really do is to not use it.

**zaphodiv** · February 2nd, 2004, 08:15 PM

I think it is unlikly that the problem is because the connection is flooded with UDP packets.

He would probably notice the data lights flashing and his internet going slowly rarther than not working at all.

Overnet uses UDP packets for querys and replys to searches. File transfers use TCP.

**Sephiroth** · February 2nd, 2004, 08:33 PM

Originally Posted by zaphodiv

I think it is unlikly that the problem is because the connection is flooded with UDP packets.

He would probably notice the data lights flashing and his internet going slowly rarther than not working at all.

Overnet uses UDP packets for querys and replys to searches. File transfers use TCP.

Querys and replys to searches make up the large majority of p2p network traffic. He said that it was like a DOS and that is really the only way that a p2p program could DOS a person using it if it uses UDP packets and overflows their connection.

**zaphodiv** · February 2nd, 2004, 09:17 PM

>Querys and replys to searches make up the large majority of p2p network traffic.
In term so number of packets and number of bytes, the search traffic generated by ed2k and overnet clients is much lower then the traffic used to transfer files.

If it was a UDP flood his connection would start working again when the flood stopped. That would also indicate a serious bug in overnet that people would have noticed by now.

The most likly expanation is that RJ5500's router crashes under heavy traffic due to buggy firmware.

**RJ5500** · February 2nd, 2004, 09:26 PM

Originally Posted by zaphodiv

>Querys and replys to searches make up the large majority of p2p network traffic.
In term so number of packets and number of bytes, the search traffic generated by ed2k and overnet clients is much lower then the traffic used to transfer files.

If it was a UDP flood his connection would start working again when the flood stopped. That would also indicate a serious bug in overnet that people would have noticed by now.

The most likly expanation is that RJ5500's router crashes under heavy traffic due to buggy firmware.

Buggy? Maybe.

I updated to the most recent firmware D-Link had to offer for my broadband router and it did not solve a thing.

**Sephiroth** · February 3rd, 2004, 07:35 AM

Originally Posted by zaphodiv

If it was a UDP flood his connection would start working again when the flood stopped. That would also indicate a serious bug in overnet that people would have noticed by now.

The most likly expanation is that RJ5500's router crashes under heavy traffic due to buggy firmware.

Thats exactly what he posted happened, the problem only happens when he uses overnet and i assume for long periods of time. And after he stopped using it then it works again.

I dont think the problem is with the router. The only way to test it is to hook the internet directly up to the PC and see if it still happens. If anything he should try updating his overnet program if it isnt already the latest release.

**PiRaNeTuS** · February 3rd, 2004, 08:15 AM

I don't know why exactly your problem was happening, but I know with me that almost every p2p network won't work when I have DHCP enabled. I had to manually foward ports and all that good stuff. So, maybe if you disable DHCP and manually config everything yourself, it will stop that. I know that edonkey/overnet worked better afterwards, anyways.

**cpugeniusmv** · February 3rd, 2004, 01:26 PM

if you are forwarding ports to a computer, you have to have a static IP on that computer...otherwise the port would just be forwarded to whatever IP you put in config...

and that of course changes every time you DHCP.

**RJ5500** · February 8th, 2004, 11:55 PM

I think I finally found an answer.

I was on the Soulseek forums and then on the eDonkey2000/Overnet forums.

http://slskboard.savagenews.com/inde...h%20list&st=15

Evidently, this problem is a lot more common than I thought.

According to

http://forum.overnet.com/viewtopic.p...kills+internet

it indeed was the UDP packets that were killing my connection, and not the Overnet program itself.

From the Overnet thread

After changing you max connection limit, you may have to wait a significant period of time because with that many accepted connections and then reducing it to a more proper level, you may actually be experienceing some sort of "denial of service" effect in which the application spends so much time briefly accepting connections only to terminate them that it has no time to do anything else.

I may need to try to alter my future Overnet configurations somehow. I am glad because I love using Overnet. It is a really good P2P client.