This is what a DDoS attack looks like
Disclaimer: VideoLAN president and lead VLC developer here.<p>The attack started on our new mirroring system (powered by mirrorbrain) 2.5 days ago, during the night (after 2am, so we were sleeping).<p>We were woken up (OP and I) in the morning by many mirrors complaining of high bandwidth use. The actual number of requests was not that high (400 req/s), but the botnet was downloading the whole vlc.exe, aka 22MB. So, we were at around 70Gbps during the night, in average.<p>Afterwards, North America got up, and things got worse. We had up to 1660 req/s, so around 292 Gbps...<p>This is very weird for a DDoS, to be honest.<p>Our front machine that splits the down mirrors was taking most of the load, and we were able to find the patterns to drop the botnet connexions, in order to not kill too much our mirrors. I won't discuss too much of the patterns, as you can imagine, but as usual, I'll be happy to discuss it IRL or by mail.<p>Tweaking the front server was also important to reduce the number of open connexions, to not kill our server.<p>2.5 days after, the attack is still going on, with an average of 500req/s.<p>The video was done using logstalgia, using scripts of OP, on my machine (<troll>he was running eclipse, he couldn't do both at the same time :)</troll>).