New attack - Printable Version

New attack - Printable Version

+- SA-MP Forums Archive (https://sampforum.blast.hk)
+-- Forum: SA-MP Server (https://sampforum.blast.hk/forumdisplay.php?fid=6)
+--- Forum: Server Support (https://sampforum.blast.hk/forumdisplay.php?fid=19)
+--- Thread: New attack (/showthread.php?tid=545530)

Pages: 1 2

Re: Kalcor Help! - kr105 - 12.11.2014

I'm able to perform this attack, I have not attacked any server but I have the resources to do it. If any of the beta testers or developers need me to target a test server for analysis please let me know. This is a very annoying and serious issue.

Re: Kalcor Help! - Khanz - 12.11.2014

There is a network level fix against IP spoofing. Contact your hosts.

Re: Kalcor Help! - Jefff - 12.11.2014

You can't block this 100%

Re: Kalcor Help! - Abagail - 13.11.2014

I'm going to bring this up again, and directed at the OP did you try this fix?

pawn Code:

new LastConnection = 0;
public OnIncomingConnection(playerid, ip_address[], port)
{
    if(LastConnection > 3)
    {
         BlockIpAddress(ip_address, 60 * 10000);
         LastConnection = 0;
         return 1;
    }
    LastConnection++;
    SetTimer("UpdateLastConnection", 2500, false);
    return 1;
}
forward UpdateLastConnection();
public UpdateLastConnection() return LastConnection = 0;

I am curious about if this would work at all or not. Assuming you still face the issue.

Re: Kalcor Help! - kr105 - 13.11.2014

@Abagail

The thing is that this attack fills the available slots on your server so new users can't connect, they get the "Server is full" message. It is also not useful to ban the IPs because they are randomly generated by the source (You don't get two same IPs on your logs). So on your code the BlockIpAddress function will never trigger.

Re: Kalcor Help! - Abagail - 13.11.2014

Quote:

Originally Posted by kr105

@Abagail

The thing is that this attack fills the available slots on your server so new users can't connect, they get the "Server is full" message. It is also not useful to ban the IPs because they are randomly generated by the source (You don't get two same IPs on your logs). So on your code the BlockIpAddress function will never trigger.

It still should block the inital connection if the attack is being spammed. It SHOULD effectively result in the "remote" players being disconnected.

Re: Kalcor Help! - Mauzen - 14.11.2014

Quote:

Originally Posted by Jefff

full info

Thats full info about the symptoms, but that still doesnt tell you much about the technical origins.
Finding the tool that is used for the attack would help a lot I guess, or maybe recording the packets.

Indeed kalcor could help us help if he would respond and ask for neccesary extra information.

Re: Kalcor Help! - Jefff - 14.11.2014

Quote:

Originally Posted by Mauzen

He can talk with

Quote:

Originally Posted by kr105

I'm able to perform this attack, I have not attacked any server but I have the resources to do it. If any of the beta testers or developers need me to target a test server for analysis please let me know. This is a very annoying and serious issue.

Re: Kalcor Help! - connork - 22.11.2014

I have this problem too, it is spoofed attack.

Re: Kalcor Help! - RajatPawar - 22.11.2014

I don't know about the solution, but about the title..

My ******** wall is bugged, help me, Mark zuckerburg!

Re: Kalcor Help! - kesarthakur - 22.11.2014

Quote:

Originally Posted by RajatPawar

I don't know about the solution, but about the title..

My ******** wall is bugged, help me, Mark zuckerburg!

its not just personal issue like ******** wall..
if kalcor can't find any solution the whole samp will fall apart..
a lot of server owners are facing this..

If this becomes major attack on all servers then it is going to be a big issue..

it is not something like my wall is bugged help Mark zuken berg

Re: Kalcor Help! - FaceTutorialz - 22.11.2014

Quote:

Originally Posted by RajatPawar

I don't know about the solution, but about the title..

My ******** wall is bugged, help me, Mark zuckerburg!

Not to bust your bubble, but the person above is correct, if it's affecting at least 25% of Kalcors and the other beta testers creation, then there's a huge problem, it isn't some minor shit like "oh my fb wall is buged, plz help mark!!!".

Re: New attack - Abagail - 04.12.2014

RIP Next Generation Gaming:
http://www.ng-gaming.net/forums/show...ected-Downtime
Hope-fully this is resolved soon.
(Don't say it's a server advertisement NGRP is shitty as fuck I'm just saying it's affecting some big servers now).

Re: New attack - Khanz - 04.12.2014

Having issue on LSRP.

Thanks to whitetiger you can use his .asi and it'll reconnect SAMP much faster.

Re: New attack - SimplyFragHosting - 04.12.2014

Hello,

there is a way to block it on the hosts end however if a legitmate player tries to join during the period of the bot spam he would also be affected (banned for at least 1 hour on certain iptable rule sets. So its not like we can't block it we just dont want to cause the server owners alot of problems with people being banned because of this as it will appear offline to them users.