Posted 07 February 2012 - 05:59 PM
First off, the IPs we are looking at are ones directly attempting to login during the incident period. The incident period differs in length, but most of the itme is less than 30 minutes (of actual flooding now due to our blockings). We do very aggressive IP blocks then which allows the login to live again. Once it is alive we start undoing the blocks. There is a threshold of "reasonable but high" that we will be trying to release immediately after the incidents. But there is a different level of attempts that gets into either a ton of players (lan cafe) or bots or deliberate flooding that we will only release after the ticket request and investigation.
If we don't do the ip blocks the login would stay down for about the full 80 minutes, which is about 70 minutes of flooding with 10 minutes of silence while the systems all restart. The ip blocks are there to block the flooding earlier so it only is down a few minutes, and then we can force restart the systems to reduce the actual down time for you all to minutes rather than quarters of hours. If we restart the systems without having the flooding stopped it will just immediately die again (this is what happened during those first 2 Saturday WoEs). We are working out more efficient policies and procedures to reduce the impact on service unfortunately it won't be "convenient" until this is stopped.