30.07.2012, 13:28
Has anybody had any experience with a DOS/DDOS-like attack that only affects a SAMP server?
Currently we host SAMP, Minecraft and TeamSpeak servers. Occasionally we'll get hit with an attack that makes everything inaccessible for 5-10 minutes while our firewall adapts, but you can tell it's happening because absolutely everything is unavailable.
This current attack, however, doesn't affect anything but our SAMP server. Anybody trying to connect to it receives a message stating the SAMP server didn't respond and anybody online at the time of the attack is kicked out and receives a message stating that SAMP server is restarting. Meanwhile, TeamSpeak and Minecraft continue merrily along.
Any time I restart the SAMP server and watch the server list in the SAMP client, I can see the ping instantly shoot through the roof and then the SAMP server stops responding.
I don't see anything in the log files and there's no connections coming through to reveal an IP address that I could potentially block.
My guess here is that somebody is using some sort of program or tool that opens thousands of connections to the SAMP server that never get past the first part of the handshake. This keeps any potential valid player connections from getting through and it also causes the SAMP server to freak out and restart.
If anybody has any advice or suggestions, I would greatly appreciate them.
Currently we host SAMP, Minecraft and TeamSpeak servers. Occasionally we'll get hit with an attack that makes everything inaccessible for 5-10 minutes while our firewall adapts, but you can tell it's happening because absolutely everything is unavailable.
This current attack, however, doesn't affect anything but our SAMP server. Anybody trying to connect to it receives a message stating the SAMP server didn't respond and anybody online at the time of the attack is kicked out and receives a message stating that SAMP server is restarting. Meanwhile, TeamSpeak and Minecraft continue merrily along.
Any time I restart the SAMP server and watch the server list in the SAMP client, I can see the ping instantly shoot through the roof and then the SAMP server stops responding.
I don't see anything in the log files and there's no connections coming through to reveal an IP address that I could potentially block.
My guess here is that somebody is using some sort of program or tool that opens thousands of connections to the SAMP server that never get past the first part of the handshake. This keeps any potential valid player connections from getting through and it also causes the SAMP server to freak out and restart.
If anybody has any advice or suggestions, I would greatly appreciate them.