[DimaShift]

[23:23:23] [connection] incoming connection: 190.76.212.106:51255 id: 55
[23:23:24] [connection] incoming connection: 79.58.114.23:36975 id: 56
[23:23:24] [connection] incoming connection: 87.105.110.151:64464 id: 57
[23:23:24] [connection] incoming connection: 180.140.112.152:25059 id: 59
[23:23:24] [connection] incoming connection: 81.199.111.154:17749 id: 60
[23:23:24] [connection] incoming connection: 180.123.68.153:13844 id: 62
[23:23:24] [connection] incoming connection: 186.49.241.156:38011 id: 63
[23:23:24] [connection] incoming connection: 2.15.198.122:20251 id: 64
[23:23:24] [connection] incoming connection: 180.253.166.213:658 id: 65
[23:23:24] [connection] incoming connection: 180.252.149.198:21396 id: 66
[23:23:24] [connection] incoming connection: 186.181.23.237:56979 id: 67
[23:23:24] [connection] incoming connection: 190.107.61.175:61406 id: 68
[23:23:24] [connection] incoming connection: 180.136.50.218:51647 id: 70
[23:23:24] [connection] incoming connection: 180.245.36.38:28492 id: 71
[23:23:24] [connection] incoming connection: 190.68.168.175:46052 id: 72
[23:23:24] [connection] incoming connection: 81.144.63.248:28589 id: 73
[23:23:25] [connection] incoming connection: 81.186.93.13:64103 id: 74
[23:23:25] [connection] incoming connection: 180.11.102.178:2096 id: 75
[23:23:25] [connection] incoming connection: 190.72.0.228:22176 id: 76
[23:23:25] [connection] incoming connection: 180.99.109.98:15103 id: 77

[Puff]

Quote:

Originally Posted by DimaShift [23:23:23] [connection] incoming connection: 190.76.212.106:51255 id: 55 [23:23:24] [connection] incoming connection: 79.58.114.23:36975 id: 56 [23:23:24] [connection] incoming connection: 87.105.110.151:64464 id: 57 [23:23:24] [connection] incoming connection: 180.140.112.152:25059 id: 59 [23:23:24] [connection] incoming connection: 81.199.111.154:17749 id: 60 [23:23:24] [connection] incoming connection: 180.123.68.153:13844 id: 62 [23:23:24] [connection] incoming connection: 186.49.241.156:38011 id: 63 [23:23:24] [connection] incoming connection: 2.15.198.122:20251 id: 64 [23:23:24] [connection] incoming connection: 180.253.166.213:658 id: 65 [23:23:24] [connection] incoming connection: 180.252.149.198:21396 id: 66 [23:23:24] [connection] incoming connection: 186.181.23.237:56979 id: 67 [23:23:24] [connection] incoming connection: 190.107.61.175:61406 id: 68 [23:23:24] [connection] incoming connection: 180.136.50.218:51647 id: 70 [23:23:24] [connection] incoming connection: 180.245.36.38:28492 id: 71 [23:23:24] [connection] incoming connection: 190.68.168.175:46052 id: 72 [23:23:24] [connection] incoming connection: 81.144.63.248:28589 id: 73 [23:23:25] [connection] incoming connection: 81.186.93.13:64103 id: 74 [23:23:25] [connection] incoming connection: 180.11.102.178:2096 id: 75 [23:23:25] [connection] incoming connection: 190.72.0.228:22176 id: 76 [23:23:25] [connection] incoming connection: 180.99.109.98:15103 id: 77

I got the exact same problem.. what is it?? how to fix it?

[Ilias_]

Quote:

Originally Posted by Puff I got the exact same problem.. what is it?? how to fix it?

its a ddos attack...

[Sgt.TheDarkness]

Quote:

Originally Posted by iliasGR its a ddos attack...

it is not a ddos attack, this is the same cookie/query flood that was used to make servers appear as if they're offline. A problem in which kalcor stated he fixed, which is clearly not the case as observed. I'm being attacked with the same vectors here. However we have protection for it.

[Puff]

Quote:

Originally Posted by Sgt.TheDarkness it is not a ddos attack, this is the same cookie/query flood that was used to make servers appear as if they're offline. A problem in which kalcor stated he fixed, which is clearly not the case as observed. I'm being attacked with the same vectors here. However we have protection for it.

What do you mean you have protection for it? how do you protect yourself against it? mind sharing?

[IstuntmanI]

You get that because you disabled cookies ! You need to change "conncookies" from Server.cfg to 1 again. Then they will just request the cookies and spam the log: for that change "cookielogging" to 0 in the same file.

That's just some flood that behaves just like a DDoS, SA-MP can't do anything against it, as you can see those IPs are spoofed again. If your server is fully working then you shouldn't worry. Most probably all servers from the hosted tab are flooded again, so they won't put too much bandwidth against your server.

[Sgt.TheDarkness]

Quote:

Originally Posted by Puff What do you mean you have protection for it? how do you protect yourself against it? mind sharing?

Absolutely, Ubi, another forum poster created a plugin that increases the rate limit (which this attack tries to exceed), which should make your server query again, try searching the forums with his username, the plugin you're looking for should be in his signature.

set conncookies to 1 in your server.cfg
leave cookielogging at 1 (or 0, either way this doesn't fix the issue)

download the windows plugin in the link below, and put it in your plugins folder, and add it to server.cfg
restart your server, and you're back online.

EDIT: I've found the link for you. http://forum.sa-mp.com/showpost.php?...&postcount=247

Quote:

Originally Posted by IstuntmanI You get that because you disabled cookies ! You need to change "conncookies" from Server.cfg to 1 again. Then they will just request the cookies and spam the log: for that change "cookielogging" to 0 in the same file. That's just some flood that behaves just like a DDoS, SA-MP can't do anything against it, as you can see those IPs are spoofed again. If your server is fully working then you shouldn't worry. Most probably all servers from the hosted tab are flooded again, so they won't put too much bandwidth against your server.

Stop recycling old posts, this doesn't fix anything dude, I promise you it doesn't, our server already has this configuration and the attacks are still occurring and are very effective, which indefinitely proves that this recycled method doesn't work (and never has)