SA-MP Forums

Go Back   SA-MP Forums > SA-MP Server > Server Support

Reply
 
Thread Tools Display Modes
Old 30/09/2017, 06:00 AM   #1
DimaShift
Banned
 
Join Date: May 2017
Location: Republic of Moldova
Posts: 123
Reputation: 43
Default full attack come back from Hosted TAB servers!

[23:23:23] [connection] incoming connection: 190.76.212.106:51255 id: 55
[23:23:24] [connection] incoming connection: 79.58.114.23:36975 id: 56
[23:23:24] [connection] incoming connection: 87.105.110.151:64464 id: 57
[23:23:24] [connection] incoming connection: 180.140.112.152:25059 id: 59
[23:23:24] [connection] incoming connection: 81.199.111.154:17749 id: 60
[23:23:24] [connection] incoming connection: 180.123.68.153:13844 id: 62
[23:23:24] [connection] incoming connection: 186.49.241.156:38011 id: 63
[23:23:24] [connection] incoming connection: 2.15.198.122:20251 id: 64
[23:23:24] [connection] incoming connection: 180.253.166.213:658 id: 65
[23:23:24] [connection] incoming connection: 180.252.149.198:21396 id: 66
[23:23:24] [connection] incoming connection: 186.181.23.237:56979 id: 67
[23:23:24] [connection] incoming connection: 190.107.61.175:61406 id: 68
[23:23:24] [connection] incoming connection: 180.136.50.218:51647 id: 70
[23:23:24] [connection] incoming connection: 180.245.36.38:28492 id: 71
[23:23:24] [connection] incoming connection: 190.68.168.175:46052 id: 72
[23:23:24] [connection] incoming connection: 81.144.63.248:28589 id: 73
[23:23:25] [connection] incoming connection: 81.186.93.13:64103 id: 74
[23:23:25] [connection] incoming connection: 180.11.102.178:2096 id: 75
[23:23:25] [connection] incoming connection: 190.72.0.228:22176 id: 76
[23:23:25] [connection] incoming connection: 180.99.109.98:15103 id: 77
DimaShift is offline   Reply With Quote
Old 30/09/2017, 02:56 PM   #2
Puff
Huge Clucker
 
Puff's Avatar
 
Join Date: Oct 2013
Posts: 249
Reputation: 17
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by DimaShift View Post
[23:23:23] [connection] incoming connection: 190.76.212.106:51255 id: 55
[23:23:24] [connection] incoming connection: 79.58.114.23:36975 id: 56
[23:23:24] [connection] incoming connection: 87.105.110.151:64464 id: 57
[23:23:24] [connection] incoming connection: 180.140.112.152:25059 id: 59
[23:23:24] [connection] incoming connection: 81.199.111.154:17749 id: 60
[23:23:24] [connection] incoming connection: 180.123.68.153:13844 id: 62
[23:23:24] [connection] incoming connection: 186.49.241.156:38011 id: 63
[23:23:24] [connection] incoming connection: 2.15.198.122:20251 id: 64
[23:23:24] [connection] incoming connection: 180.253.166.213:658 id: 65
[23:23:24] [connection] incoming connection: 180.252.149.198:21396 id: 66
[23:23:24] [connection] incoming connection: 186.181.23.237:56979 id: 67
[23:23:24] [connection] incoming connection: 190.107.61.175:61406 id: 68
[23:23:24] [connection] incoming connection: 180.136.50.218:51647 id: 70
[23:23:24] [connection] incoming connection: 180.245.36.38:28492 id: 71
[23:23:24] [connection] incoming connection: 190.68.168.175:46052 id: 72
[23:23:24] [connection] incoming connection: 81.144.63.248:28589 id: 73
[23:23:25] [connection] incoming connection: 81.186.93.13:64103 id: 74
[23:23:25] [connection] incoming connection: 180.11.102.178:2096 id: 75
[23:23:25] [connection] incoming connection: 190.72.0.228:22176 id: 76
[23:23:25] [connection] incoming connection: 180.99.109.98:15103 id: 77

I got the exact same problem.. what is it?? how to fix it?
__________________
Puff is offline   Reply With Quote
Old 30/09/2017, 03:40 PM   #3
Ilias_
Banned
 
Join Date: Jan 2017
Location: Greece
Posts: 229
Reputation: 22
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Puff View Post
I got the exact same problem.. what is it?? how to fix it?
its a ddos attack...
Ilias_ is offline   Reply With Quote
Old 30/09/2017, 04:11 PM   #4
Sgt.TheDarkness
Huge Clucker
 
Sgt.TheDarkness's Avatar
 
Join Date: Jun 2012
Location: Moscow, Russia.
Posts: 258
Reputation: 50
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by iliasGR View Post
its a ddos attack...
it is not a ddos attack, this is the same cookie/query flood that was used to make servers appear as if they're offline. A problem in which kalcor stated he fixed, which is clearly not the case as observed. I'm being attacked with the same vectors here. However we have protection for it.
__________________
Sgt.TheDarkness is offline   Reply With Quote
Old 30/09/2017, 04:14 PM   #5
Puff
Huge Clucker
 
Puff's Avatar
 
Join Date: Oct 2013
Posts: 249
Reputation: 17
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Sgt.TheDarkness View Post
it is not a ddos attack, this is the same cookie/query flood that was used to make servers appear as if they're offline. A problem in which kalcor stated he fixed, which is clearly not the case as observed. I'm being attacked with the same vectors here. However we have protection for it.
What do you mean you have protection for it? how do you protect yourself against it? mind sharing?
__________________
Puff is offline   Reply With Quote
Old 30/09/2017, 04:16 PM   #6
IstuntmanI
High-roller
 
IstuntmanI's Avatar
 
Join Date: Mar 2009
Location: Romania
Posts: 1,862
Reputation: 370
Default Re: full attack come back from Hosted TAB servers!

You get that because you disabled cookies ! You need to change "conncookies" from Server.cfg to 1 again. Then they will just request the cookies and spam the log: for that change "cookielogging" to 0 in the same file.

That's just some flood that behaves just like a DDoS, SA-MP can't do anything against it, as you can see those IPs are spoofed again. If your server is fully working then you shouldn't worry. Most probably all servers from the hosted tab are flooded again, so they won't put too much bandwidth against your server.
__________________


IstuntmanI is offline   Reply With Quote
Old 30/09/2017, 04:31 PM   #7
Sgt.TheDarkness
Huge Clucker
 
Sgt.TheDarkness's Avatar
 
Join Date: Jun 2012
Location: Moscow, Russia.
Posts: 258
Reputation: 50
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Puff View Post
What do you mean you have protection for it? how do you protect yourself against it? mind sharing?
Absolutely, Ubi, another forum poster created a plugin that increases the rate limit (which this attack tries to exceed), which should make your server query again, try searching the forums with his username, the plugin you're looking for should be in his signature.

set conncookies to 1 in your server.cfg
leave cookielogging at 1 (or 0, either way this doesn't fix the issue)

download the windows plugin in the link below, and put it in your plugins folder, and add it to server.cfg
restart your server, and you're back online.

EDIT: I've found the link for you. http://forum.sa-mp.com/showpost.php?...&postcount=247

Quote:
Originally Posted by IstuntmanI View Post
You get that because you disabled cookies ! You need to change "conncookies" from Server.cfg to 1 again. Then they will just request the cookies and spam the log: for that change "cookielogging" to 0 in the same file.

That's just some flood that behaves just like a DDoS, SA-MP can't do anything against it, as you can see those IPs are spoofed again. If your server is fully working then you shouldn't worry. Most probably all servers from the hosted tab are flooded again, so they won't put too much bandwidth against your server.
Stop recycling old posts, this doesn't fix anything dude, I promise you it doesn't, our server already has this configuration and the attacks are still occurring and are very effective, which indefinitely proves that this recycled method doesn't work (and never has)
__________________
Sgt.TheDarkness is offline   Reply With Quote
Old 30/09/2017, 04:42 PM   #8
Puff
Huge Clucker
 
Puff's Avatar
 
Join Date: Oct 2013
Posts: 249
Reputation: 17
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Sgt.TheDarkness View Post
Absolutely, Ubi, another forum poster created a plugin that increases the rate limit (which this attack tries to exceed), which should make your server query again, try searching the forums with his username, the plugin you're looking for should be in his signature.

set conncookies to 1 in your server.cfg
leave cookielogging at 1 (or 0, either way this doesn't fix the issue)

download the windows plugin in the link below, and put it in your plugins folder, and add it to server.cfg
restart your server, and you're back online.

EDIT: I've found the link for you. http://forum.sa-mp.com/showpost.php?...&postcount=247



Stop recycling old posts, this doesn't fix anything dude, I promise you it doesn't, our server already has this configuration and the attacks are still occurring and are very effective, which indefinitely proves that this recycled method doesn't work (and never has)
Oh my GOD man.. I dont know how to thank you.. LOVE U MAN <3
__________________
Puff is offline   Reply With Quote
Old 30/09/2017, 04:44 PM   #9
IstuntmanI
High-roller
 
IstuntmanI's Avatar
 
Join Date: Mar 2009
Location: Romania
Posts: 1,862
Reputation: 370
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Sgt.TheDarkness View Post
Stop recycling old posts, this doesn't fix anything dude, I promise you it doesn't, our server already has this configuration and the attacks are still occurring and are very effective, which indefinitely proves that this recycled method doesn't work (and never has)
What he posted is some kind of server full flood which was fixed by the connection cookies (which wasn't actually connecting a player anyway, that attack got deprecated in new SA-MP versions anyway). Those messages are appearing in your log from spoofed IPs requests only if you disabled the connection cookies. To fix that spam he only needs to enable connection cookies ('conncookie 1') and just disable the logging of connection cookies ('cookielogging 0') because they are being flooded and the log gets huge.

If there's some problem with the server querying being throttled, well, you just need to use the plugin Ubi provided. Kalcor may need to provide query limit changing inside server.cfg too if that query throttling is still a thing. The problem reported in this topic is fixed by the two settings in server.cfg I suggested above.
__________________


IstuntmanI is offline   Reply With Quote
Old 30/09/2017, 04:46 PM   #10
Sgt.TheDarkness
Huge Clucker
 
Sgt.TheDarkness's Avatar
 
Join Date: Jun 2012
Location: Moscow, Russia.
Posts: 258
Reputation: 50
Default Re: full attack come back from Hosted TAB servers!

Quote:
Originally Posted by Puff View Post
Oh my GOD man.. I dont know how to thank you.. LOVE U MAN <3
You are most certainly welcome.
__________________
Sgt.TheDarkness is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[Ajuda] Server Full Attack neymar1477 Português/Portuguese 7 30/04/2015 07:21 PM
Blocking <ip> due to a 'server full' attack Blacklite Scripting Help 10 24/02/2013 11:17 AM
[BUG] Server full attack rbN. Scripting Help 5 15/03/2012 09:04 PM
Full server attack from different IP's linuxthefish Server Support 4 14/02/2012 08:46 PM


All times are GMT. The time now is 08:58 AM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.