Connection flood - Printable Version

Connection flood - Printable Version

+- SA-MP Forums Archive (https://sampforum.blast.hk)
+-- Forum: SA-MP Server (https://sampforum.blast.hk/forumdisplay.php?fid=6)
+--- Forum: Server Support (https://sampforum.blast.hk/forumdisplay.php?fid=19)
+--- Thread: Connection flood (/showthread.php?tid=639868)

Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

Re: SA-MP Attacking - YouHack - 24.08.2017

@Mauzen
This attack has forced the servers to take more time than usual just to respond, and depending to my last experience of playing since yesterday, It's lagging af.

Re: SA-MP Attacking - blackgangs - 24.08.2017

No point of paying hosted-tab if your server isn't there

Re: SA-MP Attacking - Battlezone - 24.08.2017

Quote:

Originally Posted by blackgangs

No point of paying hosted-tab if your server isn't there

Quote:

Originally Posted by adri1

Server appears off but you can connect and play. (but nobody will join)
I am using 0.3.7 R2

Result: I am not paying hosted tab now.

samp should block fake packets

exactly

Re: SA-MP Attacking - Bituspy - 24.08.2017

This problem is coming on most of the servers since hours and I believe no actual SA-MP Development team has answered yet. I think if people are still paying for the hosted tab to keep this community alive the developers are responsible to inform the community about the steps they have taken to fix this matter and if they do not then they've simply grown reckless and irresponsible.
I do not believe there is much we can do cuz we do not have any control on the master server list because I am able to connect to my server even while it is offline. I am just wondering if any of you have found a way to fix this please share it over here.

Re: SA-MP Attacking - HydraHumza - 24.08.2017

This seems to be a big issue. We can temporary patch that by using blocking the ips. But the main thing if that is affecting the hosted tab than it become useless to pay for a tab.

Re: SA-MP Attacking - adri[4]Life - 24.08.2017

Quote:

Originally Posted by Bituspy

This problem is coming on most of the servers since hours and I believe no actual SA-MP Development team has answered yet. I think if people are still paying for the hosted tab to keep this community alive the developers are responsible to inform the community about the steps they have taken to fix this matter and if they do not then they've simply grown reckless and irresponsible.
I do not believe there is much we can do cuz we do not have any control on the master server list because I am able to connect to my server even while it is offline. I am just wondering if any of you have found a way to fix this please share it over here.

There won't be a solution from the scripters but from SA-MP developers
But because we're lucky enough we got a temp one:

Quote:

Originally Posted by woot

Started this morning 4am UTC on my server too, looks like every server on the hosted tab is affected. The attack is still going as of this post. The attacks always come from the same IP ranges so it's easy to block them..

Код:

To                         Action      From
--                         ------      ----
7777                       DENY IN     200.0.0.0/8
7777                       DENY IN     201.0.0.0/8
7777                       DENY IN     181.0.0.0/8
7777                       DENY IN     190.0.0.0/8
7777                       DENY IN     180.0.0.0/8

@chams:
Maybe kalcor has left, But not the beta testers i've seen matite online few hours ago
You joined july so better don't talk about 6 months ago

Re: SA-MP Attacking - Sting. - 24.08.2017

Quote:

Originally Posted by Chams

you still think that's sa-mp team will do something

they just left that shit sa-mp and they won't back , also Kalcor he may leave also .
Question to everyone ; before +6 months , did someone saw any Beta Tester or Kalcor in Online List

did you saw ??
so don't be patience just leave that shit sa-mp as they do and go play GTA IV or GTA V or Any other Game better then Waiting for Nothing .

Y_Less was online 2/3 days back. 21st I believe. He was around, he was a Beta Tester previously. Not sure whether he's one now though but I've seen many unrelated threads removed by someone, and who else can that be? Even if we think there's no one controlling the show, there is someone. Trust me on that.

Re: SA-MP Attacking - blackgangs - 24.08.2017

most of the servers are fixed now

Re: SA-MP Attacking - Chams - 24.08.2017

Quote:

Originally Posted by Sting.

That's Right Cause Most SA-MP Servers Has Been Fixed Now !! and i think Kalcor is here , and he is still Developing SA-MP .

Re: SA-MP Attacking - 1nspire - 24.08.2017

Quote:

Originally Posted by Chams

That's Right Cause Most SA-MP Servers Has Been Fixed Now !! and i think Kalcor is here , and he is still Developing SA-MP .

SA-MP team will not fix specific servers individually, if they're about to release a patch it will be global and not for half of the servers or so, the server owners have blocked the IPs themselves as a temporary solution.

If you're using a VPS, paste this in your terminal (PuTTy SSH)

Код:

iptables -I INPUT -s 188.0.0.0/8 -j DROP
iptables -I INPUT -s 180.0.0.0/8 -j DROP
iptables -I INPUT -s 181.0.0.0/8 -j DROP
iptables -I INPUT -s 186.0.0.0/8 -j DROP
iptables -I INPUT -s 190.0.0.0/8 -j DROP
iptables -I INPUT -s 200.0.0.0/8 -j DROP
iptables -I INPUT -s 201.0.0.0/8 -j DROP

...otherwise try pasting these in your samp.ban and restart the server or /rcon reloadbans, which might not really prevent the attack. I guess you could contact your host to block the ranges for you as well.

Код:

200.*.*.*
201.*.*.*
180.*.*.*
181.*.*.*
186.*.*.*
190.*.*.*
188.*.*.*

Don't forget to white-list real players from your community and/or unban these ranges after the attack is over or when they start using new ranges to flood.

Respuesta: SA-MP Attacking - FelipeAndres - 24.08.2017

Do you seriously believe this attack is new?
This attack I have done to me for years, now I'm fine thanks to another person has helped me ... I do not think that kalkor can help much here

Re: Request connection cookie flood - donB - 24.08.2017

Already a lot of threads started coming up on this. In fact, even my server log reads the similar IPs connection cookie flood. Seems to be an organised flood attack on all the SA-MP servers of hosted tab (Not sure if they would like to obtain all SA-MP servers list from SACNR Monitor). I see many posts of owners and even others stating that Firewall Ban of those specific IP ranges would temporarily fix the issue. Ofcourse, that is a good solution for now.

Please correct me if I'm wrong, but I observed that not all servers are getting affected in terms of lag, heavy player time-outs, inability of players to connect, etc. Most of the DDoS protected servers seem to be free from any sort of affects.

Re: Request connection cookie flood - Pizzy - 24.08.2017

My server is running fine with no speed or lag, it's perfect once you connect - but the whole querying of the server on the client looks as if the server is lagging or not responding - but connecting is perfectly fine.

Re: Attack | requests connection cookie. - Pizzy - 24.08.2017

Quote:

Originally Posted by iLearner

cookielogging 0 in server.cfg

helps alot: source tommyb

PS: targets of this 'attack' are servers with medium player base (40+)

That doesn't fix or help the attack. That makes it so you just can't see that an attack is happening in your server console.

Re: Respuesta: SA-MP Attacking - adri[4]Life - 24.08.2017

Quote:

Originally Posted by FelipeAndres

Do you seriously believe this attack is new?
This attack I have done to me for years, now I'm fine thanks to another person has helped me ... I do not think that kalkor can help much here

Who is kalkor?
You better read the other posts, this is not one server attack, This never happened before it attacked 3800 servers
(All the online SA-MP Servers were attacked by these shits) which makes them look offline/down while it's up and working fine

Re: Connection flood - YouHack - 24.08.2017

@adrianlouise
Actually only huge RP servers are going fine.

Re: Connection flood - TommyB - 24.08.2017

This is hardly that big of an issue. Just keep your connection cookie logging off so it doesn't cause your server to hang and inform your players that your server is actually running and to connect even if it doesn't ping properly.

Re: Connection flood - adri[4]Life - 24.08.2017

Quote:

Originally Posted by YouHack

@adrianlouise
Actually only huge RP servers are going fine.

The huge russian RP you're talking about are having daily 900+ bots online so their vps became strong and the bot attack that happened today won't effect them C:

Re: Attack | requests connection cookie. - Noir - 24.08.2017

The only thing I can also make via Windows firewall the Ip Range Bann temporarily.

Thanks for your help
<3

Re: Request connection cookie flood - -Shifty- - 24.08.2017

Quote:

Originally Posted by donB

Already a lot of threads started coming up on this. In fact, even my server log reads the similar IPs connection cookie flood. Seems to be an organised flood attack on all the SA-MP servers of hosted tab (Not sure if they would like to obtain all SA-MP servers list from SACNR Monitor). I see many posts of owners and even others stating that Firewall Ban of those specific IP ranges would temporarily fix the issue. Ofcourse, that is a good solution for now.

Please correct me if I'm wrong, but I observed that not all servers are getting affected in terms of lag, heavy player time-outs, inability of players to connect, etc. Most of the DDoS protected servers seem to be free from any sort of affects.

Yes, about 30% (30 players) could still connect before I blocked the ranges. My playerbase increased to 105 within 30 minutes when I blocked the ranges.