Get help during an attack

Use this page while an attack is taking one of your services down. Tell us about the attack first, so that we know about it while you work. Then follow the steps for the address that the attack reaches. Most of them are changes you can make yourself in the dashboard.

1. In the dashboard, select Support, then New conversation….
2. In Subject, name the service and say that it is under attack, such as survival-smp under attack.
3. Set Priority to Critical, and choose the service under About a service.
4. In Message, write what What to include lists, then select Start conversation.
5. Call +1 (302) 606-0504, and give the conversation's number, such as #1042.

If you cannot sign in, send the form on our website's attack page, as The attack page describes, or email support@coritan.com. Then call the same number. Contact support from the dashboard covers the conversation form in full.

What you can do depends on the address that the attack is sent to:

The Addresses tab of DDoS Shield lists every floating IP on your account, with what each one is Attached to. The address of a server that is not on that list is a shared address (Find your protected addresses).

DDoS Shield already filters every packet sent to the address (Filtering is always on). Check what it drops, then tighten the address's settings if the attack still gets through.

1. In the dashboard, select Security, then DDoS Shield. The Under attack tile counts the addresses with an attack in progress, and selecting it lists them. On an address's card, See attack opens the Events tab on that address. You can also select the Events tab and choose the address in the All addresses list. The link in our attack email opens the tab on the address too. An event whose Status is Ongoing has not ended. Select it to see the Attack type, the Peak rate, the Unique sources and the Sampled packets (Read attack events).
2. Open the address's Shield tab: on the Addresses tab of DDoS Shield, select Open Shield settings on the address's card, or select the card. If the profile's mode is Passthrough, set Protection mode to Standard or Custom, then select Save profile (Change the profile).
3. If the service is still down, add rules that fit it, so that less of the attack gets through (Add a rule):
   • Add an Allow rule for each port your service uses, then set When no rule matches to Drop. Traffic to every other port then stops at our points of presence. Allow the UDP replies that your machine expects as well (When no rule matches).
   • Add a Rate limit rule on the service's port, so that each sender can send only so much to it.
   • When a few senders or one network send most of the traffic, block them on the address's Blocked sources card, with an expiry such as After 1 day (Block a traffic source). The event's Sampled packets show senders, and the API's top_sources lists the busiest (Read attack events).
   • In Custom mode, lower the rate limits that the attack goes over, such as Packets per second per source (Rate limits).

A change reaches our filtering within a minute, as the profile card says. Add what you changed to the conversation.

DDoS Shield reads packet headers only, so a flood of HTTP requests that look real passes it. For a website, put the site behind a web proxy, whose web application firewall checks each request and turns away clients that send too many (Create a web proxy).

DDoS Shield does not filter the shared address of a server on App Deployment. An attack on it reaches the machine that runs your server and the other servers on that machine, and none of your settings can filter it.

1. Tell us about the attack, as Tell us about the attack describes, with the shared address and the port.
2. Attach a floating IP to the server, so that players have an address that DDoS Shield filters (Attach and detach a floating IP). If you have none, order one first (Order a floating IP). The server's ports and join addresses move to the floating IP, and a running server may restart.
3. Give players the floating IP, or the server's join address, in place of the shared address.

Attaching a floating IP does not stop the attack on the shared address, which still reaches the machine.

A join address and a web proxy resolve to Coritan's edge, so an attack on the name lands on the edge. The edge checks that traffic itself, and your DDoS Shield settings do not apply to it (What the edge checks).

• When players see Please rejoin to verify your connection., the edge is checking joins. Players should join again (What players see).
• When the name stops answering, tell us, with the name and the time it stopped.
• When the attack reaches your server anyway, the attackers know the server's own address. Follow the steps above for that address, and keep it private from then on (Keep the origin's address private).

We cannot filter a service where another provider hosts it. You can put a proxy in front of two kinds of service, with a Coritan account:

• A website can sit behind a web proxy, with the web application firewall (Create a web proxy).
• A Minecraft Java or Bedrock server can take a join address through an external server (Connect a server you host elsewhere).

A proxy stops an attack aimed at the name. An attack sent to the service's own address goes around it, so also move the service to a new address that you do not publish (Keep the origin's address private).

For any other service, or to protect address ranges of your own, email sales@coritan.com or call +1 (302) 606-0504 (Bare metal, colocation and IP transit).

In the conversation, in the attack page's form, or when you call, give:

• the address or name under attack, and the port when the attack is on one;
• when the attack started, with your time zone;
• what stopped working, and for whom;
• the Started time and Attack type of each event on the Events tab, if there are any;
• what you have changed since the attack started.

The attack page on our website, which Under Attack? at the top of the website opens, has a form for an attack in progress. Use it when you cannot sign in, or for a service that is not on a Coritan account.

1. Fill in Name, Email and, if you want to, Company or organization, Phone and Current hosting provider.
2. Under What is being attacked?, choose the kind of service, and enter its address or domain in Target IP address or domain.
3. Choose the Attack type if you know it, and fill in When did it start (your local time)?.
4. In Describe the attack, write what What to include lists, then select Request help.

The page shows We have your message with a reference, such as L-000123, and we email a confirmation with it to the address you gave. Quote the reference when you call. The page promises no call back and no time for one, and it says the request goes to our network operations team only while we email a set address about each new request. If the form cannot send your request, it says why and gives the phone number.

The form does not open a support conversation, and it is not linked to your account. For a service on your account, also tell us as Tell us about the attack describes.

The page gives the time we take to detect an attack. For your floating IPs there is nothing to start, because DDoS Shield applies its checks to every packet all the time.

• Support
• Read attack events
• Change a floating IP's DDoS protection
• Block a traffic source
• How DDoS Shield works
• TCP proxy protection

Open the conversation with POST /chat/conversations, with priority set to critical and the service's ID in service_id (Create a conversation):

curl -X POST https://api.coritan.com/api/v1/chat/conversations \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "203.0.113.10 under attack",
    "priority": "critical",
    "service_id": 214,
    "body": "UDP flood to 203.0.113.10 port 27015 since 14:02 UTC. Players cannot connect. No change on our side."
  }'

service_id here is the floating IP's service ID, the ip_service_id that GET /api/v1/client/shield/status returns (With the API).

Then follow the attack and change the address's settings:

• GET /api/v1/client/shield/events returns the events, and ip_service_id narrows them to the address. An event's active is true while it goes on (Read attack events).
• PATCH /api/v1/client/shield/subjects/{ip_service_id}/profile changes the mode, the rate limits and what happens when no rule matches, and POST /api/v1/client/shield/subjects/{ip_service_id}/rules adds a rule (Change a floating IP's DDoS protection).
• POST /api/v1/client/shield/subjects/{ip_service_id}/blocked-sources blocks an address or a range (Block a traffic source).

To block one sender for a day:

curl -X POST https://api.coritan.com/api/v1/client/shield/subjects/214/blocked-sources \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"address": "198.51.100.7", "reason": "UDP flood", "expires_minutes": 1440}'