Get help during an attack

Use this page while an attack is taking one of your services down. Tell us about the attack first, so that we know about it while you work. Then follow the steps for the address that the attack reaches. Most of them are changes you can make yourself in the dashboard.

1. In the dashboard, select Support, then New conversation….
2. In Subject, name the service and say that it is under attack, such as survival-smp under attack.
3. Set Priority to Critical, and choose the service under About a service.
4. In Message, write what What to include lists, then select Start conversation.
5. Call +1 (302) 606-0504, and give the conversation's number, such as #1042.

If you cannot sign in, email support@coritan.com and call the same number. Contact support from the dashboard covers the form in full.

Do not use the form on our website's attack page, which The attack page describes. It sends nothing.

What you can do depends on the address that the attack is sent to:

The Addresses card on the Overview tab of DDoS Shield lists every floating IP on your account, with what each one is Attached to. The address of a server that is not on that list is a shared address.

DDoS Shield already filters every packet sent to the address (Filtering is always on). Check what it drops, then tighten the address's settings if the attack still gets through.

1. In the dashboard, select DDoS Shield, then the Events tab, and choose the address in the All addresses list. An event whose Status is Mitigating has not ended. Select it to see the Attack type, the Peak rate, the Unique sources and the Sampled packets (Read attack events).
2. Open the address's Shield tab: on the Overview tab of DDoS Shield, select Manage on the address's row. If the profile's mode is Passthrough, set Protection mode to Standard or Custom, then select Save profile (Change the profile).
3. If the service is still down, add rules that fit it, so that less of the attack gets through (Add a rule):
   • Add an Allow rule for each port your service uses, then set When no rule matches to Drop. Traffic to every other port then stops at our points of presence. Allow the UDP replies that your machine expects as well (When no rule matches).
   • Add a Rate limit rule on the service's port, so that each sender can send only so much to it.
   • When a few senders send most of the traffic, add a Drop rule for each one, with its address as the Source prefix, such as 198.51.100.7/32. The event's Sampled packets show senders, and the API's top_sources lists the busiest (Read attack events).
   • In Custom mode, lower the rate limits that the attack goes over, such as Packets per second per source (Rate limits).

A change reaches our filtering within a minute, as the profile card says. Add what you changed to the conversation.

DDoS Shield reads packet headers only, so a flood of HTTP requests that look real passes it. For a website, put the site behind a web proxy, whose web application firewall checks each request and turns away clients that send too many (Create a web proxy).

DDoS Shield does not filter the shared address of a Container Apps server. An attack on it reaches the machine that runs your server and the other servers on that machine, and none of your settings can filter it.

1. Tell us about the attack, as Tell us about the attack describes, with the shared address and the port.
2. Attach a floating IP to the server, so that players have an address that DDoS Shield filters (Attach and detach a floating IP). If you have none, order one first (Order a floating IP). The server's ports and join addresses move to the floating IP, and a running server may restart.
3. Give players the floating IP, or the server's join address, in place of the shared address.

Attaching a floating IP does not stop the attack on the shared address, which still reaches the machine.

A join address and a web proxy resolve to Coritan's edge, so an attack on the name lands on the edge. The edge checks that traffic itself, and your DDoS Shield settings do not apply to it (What the edge checks).

• When players see Please rejoin to verify your connection., the edge is checking joins. Players should join again (What players see).
• When the name stops answering, tell us, with the name and the time it stopped.
• When the attack reaches your server anyway, the attackers know the server's own address. Follow the steps above for that address, and keep it private from then on (Keep the origin's address private).

We cannot filter a service where another provider hosts it. You can put a proxy in front of two kinds of service, with a Coritan account:

• A website can sit behind a web proxy, with the web application firewall (Create a web proxy).
• A Minecraft Java or Bedrock server can take a join address through an external server (Connect a server you host elsewhere).

A proxy stops an attack aimed at the name. An attack sent to the service's own address goes around it, so also move the service to a new address that you do not publish (Keep the origin's address private).

For any other service, or to protect address ranges of your own, email sales@coritan.com or call +1 (302) 606-0504 (Bare metal, colocation and IP transit).

In the conversation, or when you call, give:

• the address or name under attack, and the port when the attack is on one;
• when the attack started, with your time zone;
• what stopped working, and for whom;
• the Started time and Attack type of each event on the Events tab, if there are any;
• what you have changed since the attack started.

The attack page on our website, which Under Attack? at the top of the website opens, has a form for an attack in progress. The form sends nothing. Request Emergency Mitigation shows We have received your request, but the request reaches nobody, and nobody calls you back. Tell us as Tell us about the attack describes instead.

The page gives times to detect an attack and to start mitigating it. For your floating IPs there is nothing to start, because DDoS Shield applies its checks to every packet all the time.

• Support
• Read attack events
• Change a floating IP's DDoS protection
• How DDoS Shield works
• TCP proxy protection

Open the conversation with POST /chat/conversations, with priority set to critical and the service's ID in service_id (Create a conversation):

curl -X POST https://api.coritan.com/api/v1/chat/conversations \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "203.0.113.10 under attack",
    "priority": "critical",
    "service_id": 214,
    "body": "UDP flood to 203.0.113.10 port 27015 since 14:02 UTC. Players cannot connect. No change on our side."
  }'

service_id here is the floating IP's service ID, the ip_service_id that GET /api/v1/client/shield/status returns (With the API).

Then follow the attack and change the address's settings:

• GET /api/v1/client/shield/events returns the events, and an event's active is true while it goes on (Read attack events).
• PATCH /api/v1/client/shield/subjects/{ip_service_id}/profile changes the mode, the rate limits and what happens when no rule matches, and POST /api/v1/client/shield/subjects/{ip_service_id}/rules adds a rule (Change a floating IP's DDoS protection).

To drop one sender:

curl -X POST https://api.coritan.com/api/v1/client/shield/subjects/214/rules \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "drop-198-51-100-7", "action": "deny", "src_prefix": "198.51.100.7/32"}'