Except this time I saw no problems and played for 12 hours.
For those still awakeā¦and those who are new to the issue and maybe was enjoying some Sunday Night footballā¦ HERE IS MY RECAP OF MY WORK SO FARā¦
! have compiled alot of Wireshark logs now and have been working on spinning up a private VPN on a VPS server to try header stripping. So far via logs, dumps, traceroutes, and other data Iāve compiled from other linux users (I still havenāt found someone on Windows with the tech knowledge to also give me data) its pointing one way.
Thereās 3 issues here at play:
1.) From all 400ish posts on the large thread, by and large Comcast (Xfinity), AT&T, and Verizon are the top effected ISPs (top 3 ISPs in the USA) and may be a blanket blocklist.
2.) Its effecting IPv4 ā¦ the success reports from IPv6 are likely from the ISPs that support IPv6 to home. Just because your local network, and router/modem can, doesnāt mean the ISP is giving IPv6 to the modem (Comcast in most regions DO NOT support ipv6 at this time). This means the blackhole list was likely from DDoS mitigation effort and the botnet does not have IPv6 ability.
3.) The Linux āissueā - So a detailed scan of connection and deep packet inspection revealed what was happening at the cable level. The servers have a process: Log in server > Realm List > Handoff to Game Server. As the client hands off to the game server the packets drop, or in technical termsā¦it creates a secure connection called a TLS stream (encrypted secure TCP connection) it enters a black holeā¦the game will send āhelloā packets and ACK (confirm the server got the packet) and when it comes time for the server to complete the connection (a handshake and SYN packets) it just doesnāt respond.
We can draw some conclusions from thisā¦the active issue, see all 3 above, is not because of an active DDoS. A DDoS just floods a server with so much BS data it cant respond ā¦ we know itās not because we do get wire level responses with the TLS data streamā¦ it gets blocked half way through the line.
This means is eitherā¦ A. A blocklist B. Network Switch level deep packet inspection and rejection or C. A firewall type block preventing connection to the servers.
Thats just the explanation I have at this moment. (current best theory). Point is, someone screwed up big time. ISP blocklists, OS fingerprinting/blocklists, and possible network level filtering that was overkill and has #%##@ over paying customers. Iām on Linux, Iām seriously effectedā¦and considering just cancelling and saying hell with it.
But bottom lineā¦we, the players arenāt gonna be able to clean this mess up. This is Blizzardās problem ā¦ Sorry to be the bearer of bad news. I wish I could fix your issue, and mine. Iām tiredā¦Iām going to bedā¦and Iām to buzzed to keep staring at Wireshark logsā¦
16 Likes
Youāre a hero, man. Thanks for all this hardwork and forensics you did
1 Like
How can you post with your WoW Classic character?
Yeah, i know but itās not showing. Guess il ask support
Iām using wine under
|Distributor ID:|Ubuntu|
|Description:|Ubuntu 18.04.3 LTS|
|Release:|18.04|
|Codename:|bionic|
Same thing as someone else has said:
In retail, it wonāt even take me to realm selection.
In Classic, all realms, even Oceanics, all give the same error.
===========
Tried IPV4 / IPV6 (Both are supported with my ISP)
Telus ISP on FTTH / FTTP
Jump to another computer on windows 10 which had NO Issues during the DDOS attacks and it works just fine with my account so this is not an account black list.
I was in classic ocean walking from dustwallow marsh to tanaris to walk around thousand needles when as soon as I hit the in between path leading to each of those locations after about 5 mintues in either location got ported back to the in between path again with something like transfer aborted instance not found - no mobs / no npcs and no herbs/mines/etc, occasionally I would see a player pass on a bird from tanaris towards thousand needles.
After 20 minutes I closed the client never to be able to login properly to retail or classic again sinceā¦ yet I can go to another machine running windows 10 / login without any issue.
There was no updates that broke wine or I wouldnāt have been able to play after this mornings maint.
Diablo 3 works perfectly fine, fast, no lag no issues under wine.
About 16 days left on my sub @Blizzard blue people - unbreak it, this is NOT isp related issues, this is not packet loss or DDOS issues, many of us have proven there are some statistics here that need to be taken into account if you are doing some kind of black listing. You need better ways to decide on what traffic is legit or not (Iām sure you need to take this up with YOUR upstream provider because they are probably doing the blocking / filtering for you at the edge router or load balancer)
Donāt cop out by saying linux is unsupported because Wine is NOT an Emulator 
and you silently admitted to a big mistake by logging API fixes for linux users related to undocumented nVidia code you have access to which shouldnāt have been used in the first place. TYVM
Install Ubuntu, Install a working release of wine [ check winedb ] (the last few that I tried in early August had their own issues so reverted back to an older release prior to that) and test this yourself with an offsite connection. Iām sure there are blue posters that do the same thing - you arenāt all windows robots.
1 Like
Thank you very much, this is a great summary, and thank you for your work diagnosing the network layer. Iām also affected by the Linux blacklist and Iām eagerly waiting a solution from Blizzard.
Blocking users based on their TLS library is just insane.
Error code : WOW51900328
All Classic Realms
Windows 10 user, canāt get past loading screen after selecting characters.
Realm: Yojamba
Error: WOW51900319
1 Like
I have a char name Moomoocownow in Felstriker server, been unable to login since 9 hours ago, gets error code WOW51900328 and sometimes WOW51900319 if i remember the code correctly. I went to try to create chars in other Oceanic servers faced the same issue. Will sometimes get to enter the game for the a few minutes but with very high latency showing ping of 12k ms dropping to 5k ms, its not just unplayable but game will auto disconnect after a few minutes.
So i tried playing in another american server Arcanite reaper it works well, no issues at all.
i have done a modem reset IP reset etc. i can play wow retail and other server properly but just have problem in Oceanic servers.
hope this info is helpful to the wow staff trying to solve the issue. this is not just an angry ranting.
Windows 10 user, once login 10-15sec disconnected
Realm: Felstriker
Error: WOW51900319
1 Like
Same here. Getting disconnected shortly after logging in.
Realm: Arugal
Error: WOW51900319
Also, this only seems to be happening on all Oceanic realms for me. US realms are fine for me.
Edit: Occasionally, I do get error WOW51900328 too. This has been happening for 11h!
1 Like
Was online just a few hours ago on charter spectrum using wifi. Now I am home and canāt connect to Kirtonos using my mobile hotspot, getting Error:WOW51900319
1 Like
I use PDAnet, actually. And I had to use a proxy (VPNhub) to get logged in.
at least i didnt get a subscription, i only prepaid for a month to play classic
Is this related to IP addresses? have certain IP addresses been blocked?
I can log into my account on another PC in my home through the same network but not my main PC which i was logged in on fine last night and no settings have changed since then.
Considering playing Path of Exile at this stage if this cant be resolved
I got a new IP from xfinity and I still cant login. Im going to plug my pc into the modem to see if i can get ipv6 and attempt that
Realm: Whitemane
OS: Ubuntu 18.04
Using Lutris 0.5.3
Error: WOW51900328
Game worked flawless until this client update.