[Kaperstone]

Quote:

Originally Posted by Vince Changing the minconnectiontime parameter in server.cfg might help. I believe by default this is set to 0 so there is no delay between connection requests. You can set this to 5 seconds (5000 milliseconds) or so, depending on how often players join and leave. It might help but it probably won't stop the flooding entirely. Do these requests also trigger OnIncommingConnection? If so you might be able to filter some of them by their port numbers. Genuine clients will almost universally use a random dynamic port in the range 49152 through 65535. If the port number is lower than 49152 you can temporarily block the IP using BlockIpAddress.

The issue is that the flood doesn't reach a connection, it only requests a cookies and drops off.
There are no "Incoming Connection" as evidence to this.

It could help tho if there was something in the config to do
mincookietime to limit the cookie, which is requested before the connection.


About firewalling a range, from my last two logs (2G of this shit), this won't help.
You'll need to firewall 0 to 255

I have in my logs these ip's

Quote:

[26/08 02:24:45] [connection] incoming connection: 72.137.207.82:29501 id: 45 [26/08 02:24:45] [connection] incoming connection: 137.224.220.235:14728 id: 47 [26/08 02:24:45] [connection] incoming connection: 136.176.97.37:40778 id: 51 [26/08 02:24:45] [connection] incoming connection: 130.188.39.199:24302 id: 60 [26/08 02:24:45] [connection] incoming connection: 116.218.188.40:24880 id: 69 [26/08 02:24:45] [connection] incoming connection: 4.227.238.94:45160 id: 90 [26/08 02:24:45] [connection] incoming connection: 155.20.89.135:4243 id: 70 [26/08 02:24:45] [connection] incoming connection: 158.109.85.32:30045 id: 80 [26/08 02:24:45] [connection] incoming connection: 84.10.47.109:52085 id: 124 [26/08 02:24:45] [connection] incoming connection: 46.164.66.243:9222 id: 126 [26/08 02:24:45] [connection] incoming connection: 155.125.182.184:39582 id: 82 [26/08 02:24:45] [connection] incoming connection: 221.98.184.229:26861 id: 86 [26/08 02:24:45] [connection] incoming connection: 12.157.79.167:48454 id: 168 [26/08 02:24:45] [connection] incoming connection: 121.98.56.243:19838 id: 88 [26/08 02:24:45] [connection] incoming connection: 37.142.95.176:64620 id: 175 [26/08 02:24:45] [connection] incoming connection: 154.44.5.143:2014 id: 196 [26/08 02:24:45] [connection] incoming connection: 95.30.57.1:26757 id: 199 [26/08 02:24:46] [connection] incoming connection: 165.57.25.98:50015 id: 6 [26/08 02:24:46] [connection] incoming connection: 161.23.237.233:58871 id: 91 [26/08 02:24:46] [connection] incoming connection: 212.72.196.87:18678 id: 110 [26/08 02:24:46] [connection] incoming connection: 190.86.41.248:6581 id: 113 [26/08 02:24:46] [connection] incoming connection: 189.7.82.100:12468 id: 127 [26/08 02:24:46] [connection] incoming connection: 83.79.3.5:64839 id: 75 [26/08 02:24:46] [connection] incoming connection: 179.139.88.203:60271 id: 129 [26/08 02:24:46] [connection] incoming connection: 168.45.240.134:17075 id: 136 [26/08 02:24:46] [connection] incoming connection: 55.31.253.149:37455 id: 138 [26/08 02:24:46] [connection] incoming connection: 39.127.114.135:2574 id: 139 [26/08 02:24:46] [connection] incoming connection: 49.251.238.100:23764 id: 156 [26/08 02:24:46] [connection] incoming connection: 185.77.199.158:28161 id: 2 [26/08 02:24:46] [connection] incoming connection: 167.61.141.242:6848 id: 13 [26/08 02:24:46] [connection] incoming connection: 97.86.161.163:9094 id: 165 [26/08 02:24:46] [connection] incoming connection: 178.18.170.52:33720 id: 177 [26/08 02:24:46] [connection] incoming connection: 57.214.141.227:47863 id: 192 [26/08 02:24:47] [connection] incoming connection: 52.94.226.133:65499 id: 17 [26/08 02:24:47] [connection] incoming connection: 109.106.101.97:48340 id: 8 [26/08 02:24:47] [connection] incoming connection: 221.48.147.113:58003 id: 19 [26/08 02:24:47] [connection] incoming connection: 223.64.61.162:24609 id: 23 [26/08 02:24:47] [connection] incoming connection: 31.199.185.184:25503 id: 83 [26/08 02:24:47] [connection] incoming connection: 136.212.252.41:9113 id: 195 [26/08 02:24:47] [connection] incoming connection: 196.23.132.159:13136 id: 27 [26/08 02:24:47] [connection] incoming connection: 163.236.236.91:61266 id: 31 [26/08 02:24:47] [connection] incoming connection: 126.33.210.231:32093 id: 85 [26/08 02:24:47] [connection] incoming connection: 203.118.14.57:59577 id: 34 [26/08 02:24:47] [connection] incoming connection: 160.79.103.134:23797 id: 43 [26/08 02:24:47] [connection] incoming connection: 46.209.184.210:45653 id: 63 [26/08 02:24:47] [connection] incoming connection: 95.114.243.250:22837 id: 92 [26/08 02:24:47] [connection] incoming connection: 109.99.172.16:33482 id: 93 [26/08 02:24:47] [connection] incoming connection: 106.40.52.0:61913 id: 94 [26/08 02:24:47] [connection] incoming connection: 172.110.228.150:27597 id: 96 [26/08 02:24:47] [connection] incoming connection: 162.216.218.8:9488 id: 98 [26/08 02:24:47] [connection] incoming connection: 223.239.189.132:58889 id: 100 [26/08 02:24:47] [connection] incoming connection: 66.9.164.186:9203 id: 101 [26/08 02:24:47] [connection] incoming connection: 72.161.187.125:532 id: 5 [26/08 02:24:48] [connection] incoming connection: 78.143.2.88:21058 id: 102 [26/08 02:24:48] [connection] incoming connection: 133.12.196.94:44664 id: 25 [26/08 02:24:48] [connection] incoming connection: 110.114.194.7:12189 id: 61 [26/08 02:24:48] [connection] incoming connection: 81.82.160.57:29961 id: 103

(from the time I turned off the cookies)

As you can see, there are 223.* and there is even one 4.* and lots of between.

What we could only do is update Gamer_Z's Anti Server Full Attack plugin, turn off the cookies and use the plugin instead.
(As of now, it seems a lot more realistic than waiting for an update from Kalcor)
But unfortunately, the plugin works only for 0.3z R4.



EDIT: I noticed that the ports are even smaller than 49152, so targeting port is also useless.