tl; dr; but if you are considering changing technology be sure to check redis. I love memcache but I wouldn't like my shares to stay just in memory.

Attacker flooding the server had IP 69.72.189.147

LoL   Really,  so easy to dismiss just trying to contribute, Varnish is an HTTP cache engine, Memcached is an engine that allows storage of data to memory, they’re not the same so they can’t be compared so black and white me thinks.

In fact surely they idea is not that idiotic , i.e if a visitor has no login session cookie then nginx will serve the page cache from Varnish, and then additionally even with the session cookie you can serve content generated from memcache but stored in varnish all offloading work from nginx and most likely reducing cpu usage and internal network bandwidth. Its highly configurable and you shouldn't treat is a dumb cache.

But its a bit hard to make a sweeping statement without knowing the internal bottlenecks generated by the attack.

just another 2 cents to the original 2 cents. or should i say 0.02 btc.

Or just blocking all IP addresses from the home of capitalism might solve the problem  , of course that might not be so open an fair and break the spirit of bitcoin.   

Suggestion...

iptables -A INPUT -s <ip> -j DROP

Problem solved.  I even blocked a whole ISP because someone was jumping around their IP space.
We've been getting attacked off and on for two weeks now.  Looks like someone has it out for the bitcoin pools indeed.

Yes perhaps a little extreme to block a whole country especially such a big one (not a serious suggestion) although a block on isp like suggested by iptables post could be considered in case of consistent repeated attack.

but.... is it fair to block a whole isp i would also ask, perhaps one individual is ruining it for others, i would probably stick with individual ips until more attacks from the same range where detected. The fact that only 1 ip was used for the attack shows its the intent of 1 at the moment and not some botnet attack.

but kudos to slush as he managed to keep the mining running, but i think it does have confidence hit on miners, when the site is not visible, as we could see that last night of bitcoinwatch as people went back to slush after the site was back up.

Yes, I blocked him with iptables, too. Easiest solution. Currently site has rate limiter and iptables blacklist.


Nice idea, I'll join this effort if fairuser & tycho agree (and I already published the one IP .

yep... maybe it is possible, but very strange that pool can't find block for so long
Current shares CFD:   99.98 % - and still no block

Doing all of the above.

I can't even comprehend the type of attack this would take to pull this off. Granted, I'm still a noob, but you guys are definitely teaching me. I left Slush's the other night for a few hours and felt awful about it...been with the pool since I started with my CPU, pulling a nickel every day and a half. (and doing a hell of a lot better now, tyvm)

It must be an awesome block to be taking this long.