[HeLiOn_PrImE]

There is a new type of flood running around. The tool shuts down the server almost immediately. I successfully range banned the attacker after he targeted my server, because he was foolish enough to send me pm messages about it and showing off. Thought you guys should know, maybe someone comes up with a counter measure..

[Unknownich]

What type of flood, can u post any server or bandwidth logs?.

[HeLiOn_PrImE]

I've picked up this. This is the number of attacks per second. I don't get it, my server is scripted to ban the IP's that make more than 4 connections.

Quote:

[10:46:03] Incoming connection: 79.118.59.159:65472 [10:46:03] Incoming connection: 79.118.59.159:65473 [10:46:03] Incoming connection: 79.118.59.159:65474 [10:46:03] Incoming connection: 79.118.59.159:65475 [10:46:03] Incoming connection: 79.118.59.159:65476 [10:46:03] Incoming connection: 79.118.59.159:65477 [10:46:03] Incoming connection: 79.118.59.159:65479 [10:46:03] Incoming connection: 79.118.59.159:65478 [10:46:03] Incoming connection: 79.118.59.159:65480 [10:46:03] Incoming connection: 79.118.59.159:65482 [10:46:03] Incoming connection: 79.118.59.159:65483 [10:46:03] Incoming connection: 79.118.59.159:65481 [10:46:03] Incoming connection: 79.118.59.159:65484 [10:46:03] Incoming connection: 79.118.59.159:65485 [10:46:03] Incoming connection: 79.118.59.159:65486 [10:46:03] Incoming connection: 79.118.59.159:65487 [10:46:03] Incoming connection: 79.118.59.159:65488 [10:46:03] Incoming connection: 79.118.59.159:65489 [10:46:03] Incoming connection: 79.118.59.159:65490 [10:46:03] Incoming connection: 79.118.59.159:65492 [10:46:03] Incoming connection: 79.118.59.159:65493 [10:46:03] Incoming connection: 79.118.59.159:65491 [10:46:03] Incoming connection: 79.118.59.159:65494 [10:46:03] Incoming connection: 79.118.59.159:65495 [10:46:03] Incoming connection: 79.118.59.159:65497 [10:46:03] Incoming connection: 79.118.59.159:65496 [10:46:03] Incoming connection: 79.118.59.159:65498 [10:46:03] Incoming connection: 79.118.59.159:65499 [10:46:03] Incoming connection: 79.118.59.159:65500 [10:46:03] Incoming connection: 79.118.59.159:65502 [10:46:03] Incoming connection: 79.118.59.159:65501 [10:46:03] Incoming connection: 79.118.59.159:65503 [10:46:03] Incoming connection: 79.118.59.159:65505 [10:46:03] Incoming connection: 79.118.59.159:65504 [10:46:03] Incoming connection: 79.118.59.159:65506 [10:46:03] Incoming connection: 79.118.59.159:65507 [10:46:03] Incoming connection: 79.118.59.159:65508 [10:46:03] Incoming connection: 79.118.59.159:65509 [10:46:03] Incoming connection: 79.118.59.159:65510 [10:46:03] Incoming connection: 79.118.59.159:65511 [10:46:03] Incoming connection: 79.118.59.159:65512 [10:46:03] Incoming connection: 79.118.59.159:65513 [10:46:03] Incoming connection: 79.118.59.159:65514 [10:46:03] Incoming connection: 79.118.59.159:65515 [10:46:03] Incoming connection: 79.118.59.159:65516 [10:46:03] Incoming connection: 79.118.59.159:65517 [10:46:03] Incoming connection: 79.118.59.159:65518 [10:46:03] Incoming connection: 79.118.59.159:65519 [10:46:03] Incoming connection: 79.118.59.159:65521 [10:46:03] Incoming connection: 79.118.59.159:65520 [10:46:03] Incoming connection: 79.118.59.159:65522 [10:46:03] Incoming connection: 79.118.59.159:65523 [10:46:03] Incoming connection: 79.118.59.159:65524 [10:46:03] Incoming connection: 79.118.59.159:65525 [10:46:03] Incoming connection: 79.118.59.159:65526 [10:46:03] Incoming connection: 79.118.59.159:65527 [10:46:03] Incoming connection: 79.118.59.159:65529 [10:46:03] Incoming connection: 79.118.59.159:65528 [10:46:03] Incoming connection: 79.118.59.159:65530 [10:46:03] Incoming connection: 79.118.59.159:65531 [10:46:03] Incoming connection: 79.118.59.159:65532 [10:46:03] Incoming connection: 79.118.59.159:65533 [10:46:03] Incoming connection: 79.118.59.159:49152 [10:46:03] Incoming connection: 79.118.59.159:65534 [10:46:03] Incoming connection: 79.118.59.159:49153 [10:46:03] Incoming connection: 79.118.59.159:49154 [10:46:03] Incoming connection: 79.118.59.159:49155 [10:46:03] Incoming connection: 79.118.59.159:49156 [10:46:03] Incoming connection: 79.118.59.159:49157 [10:46:03] Incoming connection: 79.118.59.159:49158 [10:46:03] Incoming connection: 79.118.59.159:49159 [10:46:03] Incoming connection: 79.118.59.159:49160 [10:46:03] Incoming connection: 79.118.59.159:49161 [10:46:03] Incoming connection: 79.118.59.159:49163 [10:46:03] Incoming connection: 79.118.59.159:49162 [10:46:03] Incoming connection: 79.118.59.159:49165 [10:46:03] Incoming connection: 79.118.59.159:49164 [10:46:03] Incoming connection: 79.118.59.159:49166 [10:46:03] Incoming connection: 79.118.59.159:49167 [10:46:03] Incoming connection: 79.118.59.159:49168 [10:46:03] Incoming connection: 79.118.59.159:49169 [10:46:03] Incoming connection: 79.118.59.159:49170 [10:46:03] Incoming connection: 79.118.59.159:49172 [10:46:03] Incoming connection: 79.118.59.159:49171 [10:46:03] Incoming connection: 79.118.59.159:49173 [10:46:03] Incoming connection: 79.118.59.159:49175 [10:46:03] Incoming connection: 79.118.59.159:49174 [10:46:03] Incoming connection: 79.118.59.159:49176 [10:46:03] Incoming connection: 79.118.59.159:49177 [10:46:03] Incoming connection: 79.118.59.159:49178 [10:46:03] Incoming connection: 79.118.59.159:49179 [10:46:03] Incoming connection: 79.118.59.159:49181 [10:46:03] Incoming connection: 79.118.59.159:49180 [10:46:03] Incoming connection: 79.118.59.159:49182 [10:46:03] Incoming connection: 79.118.59.159:49184 [10:46:03] Incoming connection: 79.118.59.159:49185 [10:46:03] Incoming connection: 79.118.59.159:49183 [10:46:03] Incoming connection: 79.118.59.159:49186 [10:46:03] Incoming connection: 79.118.59.159:49187 [10:46:03] Incoming connection: 79.118.59.159:49188 [10:46:03] Incoming connection: 79.118.59.159:49189 [10:46:03] Incoming connection: 79.118.59.159:49190 [10:46:03] Incoming connection: 79.118.59.159:49191 [10:46:03] Incoming connection: 79.118.59.159:49192 [10:46:03] Incoming connection: 79.118.59.159:49193 [10:46:03] Incoming connection: 79.118.59.159:49194 [10:46:03] Incoming connection: 79.118.59.159:49195 [10:46:03] Incoming connection: 79.118.59.159:49196 [10:46:03] Incoming connection: 79.118.59.159:49197 [10:46:03] Incoming connection: 79.118.59.159:49198

[Moh_]

Quote:

Originally Posted by HeLiOn_PrImE I've picked up this. This is the number of attacks per second. I don't get it, my server is scripted to ban the IP's that make more than 4 connections.

as u can see in the logs, its an incoming connection...so its not in the server.
incoming connections messages are client-side.

[HeLiOn_PrImE]

Exactly. But as far as I know, the sa-mp client can't make that many connections in 1 second. My server is scripted correctly, but looks like it was to much for it to hande. After all it's a DDOS attack. That's what it looks like...

[Pizzy]

It's not a DDoS since it's all one IP. It's a flooder by the looks of it.

[coole210]

That is just a DoS, 1 single IP attacking the server. You just have bad security. The attacks I experienced were booters with a long range of different IPs from across the world going at around 40 MBps.

[carz0159]

there isn't much you can do. I recommend confronting the attacker, and finding out his motives, if the attacker pmed you, show us the pms

[Mauzen]

Quote:

Originally Posted by HeLiOn_PrImE maybe someone comes up with a counter measure..

Send all logs and IPs to the IPs provider and wait for a kid getting trouble with his parents for the internet shutdown.

[HeLiOn_PrImE]

so far he god banned, so I won't be gearing from him no more...