DDos symptoms but its not being ddosed?
#1

My server has been going down every 2 - 20 minutes. When the server goes down the ping skyrockets to around 1400 then every player in the server looses connections for a few minutes. I am able to still connect to the box through the RDC, and use the internet on the box, so its not a ddos. Is there some new tool to attack samp servers?

I have tried everything I can think of blocking the "con" exploit on windows, adding rcon 0 to server.cfg I even tried using VM manager to create a virtual machine and run a different operating system, and before you ask yes I installed this patch to the samp server (https://sampforum.blast.hk/showthread.php?tid=486023). Whatever is going on its only effecting the samp server itself as everything else running on the box is still working fine. Even if I have two samp servers running on different ports, only one goes down. I was originally thinking it had something to do with the mysql, but thats not the case, when both servers are on the same database both would go down if that was the problem.

The server runs windows server 2012(I virutalized part of the machine and installed windows server 2008 and had the same results) it isn't a script error, we haven't updated the script recently so its not the code. The CPU usage during this stays between 20-25%. I am very confused here, the same thing was happening about 12 hours ago but after rebooting the box everything was fine then it started happening again. Does anyone have any clue on what could be causing this? From a players stand point it looks identical to ddos attacks but the network logs show that it isn't.
Reply
#2

https://sampforum.blast.hk/showthread.php?tid=486023
Reply
#3

Quote:
Originally Posted by Tamer T
Посмотреть сообщение
Yeah I am using that.
Reply
#4

Bumping this, its definitely an attack of some sort, it started happening out of the blue, hasn't stopped since. If this was a script error or server error wouldn't restarting help it for a whle since it ran for hours and hours with no issues before? Nothing has changed and we had ovh check their hardware, any suggestions?

Right before the server drops it says "Incoming connection from ip XXX.XX.XXX and that ip isn't registered anywhere in the database, and is tracing back to countries like russia latvia and poland. I may be paranoid but I doubt a new player finds the server RIGHT as its being attacked in succession for the past 12 hours.
Reply
#5

When there is a exploit or vulnerability of sa-mp, this makes than all servers are being attack, you have to look at the hosted list and as are the other servers, when an exploit was discovered in the 0.3x server (view http://forum.samp.com/showthread.php?t=485833) attacked all servers, not just one.
Reply
#6

Just because one hacker decided to attack all samp servers doesn't mean anyone else will. Also this could very possibly be some old exploit that I am not thinking of, causing the issue that can be fixed with scripting(such as the rcon login flooder).
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)