DDoS / DoS (Denial-of-Service) Attack Prevention

What is a DDoS? 
A denial-of-service attack (DoS attack), also known as a distributed denial-of-service attack (DDoS attack), attempts to make a computer or network resource unavailable to its intended users by sending thousands of packets to a person’s computer.
DoS attacks come from one location and can often be thwarted (depending on the technical knowledge of the attacker). A Distributed Denial of Service attack, however, comes from multiple locations and is therefore more difficult to prevent since the IP addresses of the attacker(s) come from several locations. Most routers will allow you to block a range of IP addresses, but this can lead to problems (e.g. accidentally blocking websites and applications) if not done carefully.

The following symptoms are usually NOT due to DDoS attacks:

· Periodic in-game lag.
· An internet connection that sometimes runs slow out of game.
· Experiencing random disconnects followed by reconnects.

The above symptoms describe latency issues. Please check out the most common fixes for latency in this Knowledge Base article:https://support.leagueoflegends.com/entries/20102243-improving-lag-latency-and-ping
If you believe you are victim of a DoS or DDos attack, please read the following guide:

1st – Get your IP Address:
The easiest way to do this is to go to http://www.whatismyip.com and write this number down. This will display your external IP address.

2^nd - Determine if you are being DDoS’d or not: 
There are a few ways to confirm if you are being attacked - we highly recommend going through every step.

• First, open a Command Prompt by pressing Win+R and typing “cmd”:

· Next we will attempt to ping the outside world. (Using Reddit.com as our example). Type ping reddit.com –n 10 into the Command Prompt window.



Pay attention to the number next to ‘time =’ and the percentage of packets loss displayed below ‘Ping statistics’. The time column is the amount of time it takes for a packet that is 32 bytes in size to travel from your computer, to Reddit’s servers, and then back to your computer. While playing League of Legends this number is referred to as your Latency.

In the beginning stages of a DoS attack, this number will increase periodically (40ms to 800ms) and will eventually respond with “Request timed out”. If you believe you are being DDoS’d, the first thing to do is open a command prompt and ping a reliable website that you know is online (Reddit, Google, etc). Most amateur DDoS attacks take time to build up steam so you can usually catch the less sophisticated attacks before they take you completely offline.
Who is attacking me and what can I do about it?
DDoS attacks are often done via botnets that are spaced out across hundreds of IP addresses. Many of these attacks come from individuals attempting to disrupt gameplay by using third party programs in combination with player IP Addresses.
To find where a DoS attack is coming from, you can download and run a program called ‘TCPView’. TCPView displays all current connections (endpoints) on your computer. A DoS attack’s origin becomes very clear with this program, as TCPView will be able to identify a connection that is running 100’s of times. From there, you can plug the IP address of this connection into ‘www.whois.sc’ and find out the attacker’s ISP. After that, contacting the ISP to explain the situation would be your next best step.

DDoS Solutions 
Problem: 
You are positive that you are being hit by a Distributed DoS attack and you are completely disconnected from the internet. You can’t ping any websites and all your applications are offline.

Solution: 
Please understand that some of these steps (3 & 4) are outdated and will more than likely not work.
They are included however as a precursor for some of the sections later on in the guide.
Your best short-term solution is to change your IP Address since the DDoS attacks are directed at your IP and nothing else.
Note: There are two different ways that your ISP can provide you with an IP Address: Dynamically or Statically. Dynamic IP addresses are assigned each time you log on the ISP’s network. This doesn’t necessarily mean your ISP will change your IP each and every time your restart your computer as it is solely dependent on your service provider.
A Static IP is exactly what it sounds like - static and never changing. Static IP addressing is much less secure since you are provided an IP that never changes. I highly suggest calling your ISP and finding our 1) What type of addressing you have and 2) If you are Static, is there any possibility to be changed to dynamic.
Unplug your cable/dsl modem as well as your router and wait 60-120 seconds. Plug back in and check www.whatismyip.com to see if you were assigned a new IP.

Call your ISP and tell them that you are being DDoS’d and that you need a new IP Address. Most ISPs will be receptive, though you may need to request to be escalated to a higher level of customer support.

Open a command prompt (Win+R, then type ‘cmd’) and type ‘ipconfig /release’ (This will disconnect you from the internet)

Type ‘ipconfig /renew’

Finally, type “ipconfig /all’ to display a great deal of network information.

Look for the default gateway:



Type your default gateway into your internet browser to bring up your routers' admin page. You will need to know what type of router you have in order to find the default username and password. Some common ones are “root/password”, “admin/password”, “password/password” and “admin/admin”. Once you have access, you can attempt to Release/Renew you IP here.

Here is a screenshot of a standard router configuration page:


DDoS Prevention Options
VPN 
Using VPN software is generally the best way to prevent becoming the victim of a DoS attack.  Unfortunately, these types of software can have negative interactions with League of Legends.  As VPN Software will assign you an IP Address, it will often increase your in-game latency significantly if the IP Address you are assigned is further away from our servers than you are actually located.  Additionally, if the VPN software you are using frequently changes your IP Address, there is the chance it could change mid-game, which would result in you being immediately disconnected. This is because our servers are expecting a connection from the original IP Address and cannot adjust for the sudden change in IP during a game. (Please note: consistently leaving games will increase your Leaver Level: https://support.leagueoflegends.com/entries/20030633-leaving-games-the-leaverbuster-faq )

Skype Proxy (Solution 1)
Making a Skype connection with someone is the most common way for them to gain access to your IP Address, as you don’t even need to friend someone for that information to be visible.  The following solution should help you avoid displaying an accurate IP Address while still allowing you access to Skype to communicate with your Team.

• In Skype, Go to Tools -> Options -> Advanced -> Connection
• Check the box that says "Use port 80 and 443 as alternatives for incoming connections"
• Click this drop-down and change it to "SOCKS5"

• Go to http://www.xroxy.com/proxy-country.htm
• Select the Country that you reside, pick any “SOCK5” IP Address from the list and enter it as the host.
  Note: What you are doing is running Skype via a proxy. As long as you pick an IP that is in the same country as you reside then you shouldn’t see much, if any degradation in call quality. If you do, just select a new IP until you find the best setup.

Skype Proxy (Solution 2)

• Open notepad and paste the following (substituting the proxy information with your proxy server)

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone]
"DisableSupernode"=dword:00000001
"ProxySetting"="HTTPS"
"ProxyAddress"="x.x.x.x:yyyy"
"ProxyUsername"="username"
"ProxyPassword"="password"

Save the file as a .reg (Example: skype.reg) and then double click on it and confirm.

For additional information regarding prevention of DDoS attacks, we suggest the following guide written by Matthew Gunnin (Please note that we are unable to officially endorse the contents of this article):
source : http://www.leaguepedia.com/wiki/DDoS_Prevention_Guide