I run some webservers which serve small javascript files ( which are web widgets of about 8kb ) , I have several servers moved on ovh where I also have other services ( I also use their cdn service which is not bad )
the problem is that those servers trigger the anti DDoS service which WRONGLY think that legitimate traffic is an attack, put the server under filtering and I loose about 30% of the traffic.. my clients are complaining , my internal statistics show also evidence of the problem since I've moved on ovh, when ovh remove the filter immediately the widget success rate increase from 70% to about 99%
( I can only see that in http 200-response and in client-recordered metrics ) the problem is that severs that should handle 500Mbps of traffic are "limited" to less than 70Mbps due to that filter... ( also with server resources ( cpu/ram usage under 30% ) )
I know that serving 8kb/request at 70Mbps is quite a lot, each server receive about 3000 connections/second which for a normal website could look like a DDoS , but for me It's normal traffic!
I know what I'm talking about because I was serving same widgets on softlayer since a month ago with 1/4 of the ram per server and 1/2 of the servers ( and the have a DDoS too but probably less aggressively configured )
I don't even know if I can order multiple very small servers instead of less big servers to workaround that issue because OVH don't want to tell me the DDoS threshold that is hitting me ( Packet per seconds ? ip / seconds ? conntrack ? what ? ) are thresholds equals for all servers ? there is no documentation.
the not so funny part of all that is..
I've already opened a ticket for that.. 6528169741 , and in 9 days I have yet to reach a tech, on day one a "tech" from italy team asked me a tcpdump which I provided in MINUTES , then silence for days, after a call the tech told me that the dump was too big.. ( about 100mb ) , I asked which size would be better for them and he told me about 3mb, I said ok , but you could have truncated the tcpdump yourself with the tcpdump command to the size you want.. anyway I've uploaded immediately a new tcpdump of 3mb, no reply for more days..
after 6 days of ticket.. another italian "tech" told me that have opened an internal ticket.. after 3 days I'm still waiting.. not knowing a lot of things :
- If the problem can be fixed ( DDoS thresholds adjusted )
- how to handle such cases in future ( having to fight with "tech" support for days to get a reply is not my work ) /new servers
Dedicated Servers - Anti-DDoS too aggressive, shaping my traffic to less than 70mb/sec ( on 7 servers.. )
Related questions
- Blacklisted IP ranges by UCEPROTECTL3
38435
23.02.2021 09:08
- Hot to delete my account?
36729
29.07.2018 19:49
- Proxmox + opnsense
30662
19.07.2018 15:53
- Upcoming change: EFI System Partition over RAID1 for Linux installations
30455
08.10.2025 16:29
- Free easy to setup OpenWRT NAT firewall for OVH (c)ESXi dedicated hosts
30436
16.05.2022 07:18
- Network Resilience Improvement for LACP aggregation on OVHcloud Bare Metal Servers
28901
27.10.2025 11:21
- .iso install on IPMI very slow
27983
22.05.2018 11:14
- Purchased a dedicated server - Awaiting Validation on a Saturday
27954
19.05.2018 20:07
- KVM error, blank screen, not send Keys
27778
11.12.2021 11:45
- Can't cancel/return server
25952
25.06.2018 08:31