[toyota]

Hi guys

Having a strange server problem here. The server randomly disconnects all players, including npcs, and players see a message "the server is restarting..."

When it happens, all connectivity on the server goes down for about 10-20 seconds, and it happens at any time. Using a network monitor, there is a little packet loss when it happens, and sometimes the samp-console displays lots of Packet was modified messages from a random player.

I have included a screenshot of Performance Monitor from the VPS when it happens, showing the network total bytes/second. I have hidden it on the picture, but the total bandwidth always sits at 100.

At first we thought it was a server problem, but we moved to a new VPS and the problem still happens. Does anyone know what could cause this?

Edit: Incase it helps, I've just changed the graph to show bytes received and bytes sent instead of bytes total, and it is bytes received that shoots up. This time though I was the only player on the server, so its not an attack that is causing this.
Also should mention when the connection goes back to normal and players try to rejoin, it often shows 5-10 incoming connections for each player, so they end up with higher id numbers.

Thanks

[WarServers]

Sounds like they are timing out due to a DDOS attack.

[toyota]

Hmm, I'm not sure, when it happens its only for a few seconds, not constant. Pings never shoot up or anything like that. Also we changed to a different server and it began again immediately.

Today it happened again, but differently. All other players pings went to 0, but I could still see them in the list. No commands or anything would work, but I didn't timeout. When I went into the console, exit did nothing, it was as if I had typed an unrecognized command. 'players' still worked however, and I could see "Incoming connection:" messages, but that was as far as they got, noone actually gave a connected message. I had to manually close the window and restart the server.

[[DDC]Delight]

Quote:

Originally Posted by WarServers Sounds like they are timing out due to a DDOS attack.

It isn't DDoS..

And our console gets spammed with the message:

Код:

Packet was modified, send by (playerid)

And we get random incomming connection messages, while the player with that IP is already inside the server..

Any help please, it's annoys the shit outa me

[toyota]

If it did turn out to be someone Ddos'ing for like, 20 seconds at a time, would that cause all players on 127.0.0.1 (npcs) to timeout?

[Max_Coldheart]

That "Packet Modified" means that you are indeed being DDoS'd

[toyota]

I should mention that the packet modified message doesn't always appear when this happens, and it comes from any player, sometimes me, sometimes an NPC. From reading the wiki I had the idea that Packet Modified was something that happened when a player was having connection problems, not necessarily indication DDoS.

If we are being DDoS'ed randomly, for short bursts, how can we defend against it? The people doing the DDoSing never get ingame, so we can't get the IP from there. We are running on a Windows Server 2008 R2 VPS, if that's of any help.

Thanks again