SA-MP Forums

Go Back   SA-MP Forums > SA-MP Server > Server Support

Reply
 
Thread Tools Display Modes
Old 14/04/2019, 10:25 PM   #61
Kalcor
SA-MP Developer
 
Join Date: Apr 2005
Posts: 1,180
Reputation: 2872
Default Re: Servers are getting attacked

My server isn't crashing. It's possible servers are using a memory plugin for R2 server.

Do you know how to get a backtrace?

run the server in gdb
Code:
$ gdb samp03srv
(gdb) run
* wait for crash*
(gdb) bt
Post the log of the bt
Kalcor is offline   Reply With Quote
Old 14/04/2019, 10:48 PM   #62
xo
Big Clucker
 
xo's Avatar
 
Join Date: Dec 2013
Location: I don't know.
Posts: 174
Reputation: 78
Default Re: Servers are getting attacked

@Ubi take a look on OVH's docs: https://us.ovhcloud.com/products/security/anti-ddos

They provide custom routines for specific game servers ( including SA:MP ) using their hardware. To analyze both incoming and outgoing packets (high outgoing traffic originally caused by UDP flood by spoofed packets? which are already filtered by their hardware based on the game server type) and their causes and start mitigating them + the packet caching they use

Though, that only exist on the game range of servers.

I got attacked not so long ago on my server for a week by the same method, switching to to a GAME firewall did the job.

Two-way mitigation: a filter on entry and exit
For every type of attack, we've built a specific response closely integrated to the servers and directly integrated within the Tilera hardware. The big innovation is a filter that analyzes the incoming and outgoing traffic to better identify legitimate requests. It's capable of distinguishing real clients connecting to the machine from harmful attacks. Anti-DDoS GAME therefore also plays the role of a cache and a filter for TCP/IP and UDP packets.


A router located next to the machine analyzes packets. This router treats every hosted game as a special case. For example, the router acts as a cache to relieve the router of useless requests.
xo is offline   Reply With Quote
Old 14/04/2019, 11:23 PM   #63
Ubi
Little Clucker
 
Join Date: Sep 2011
Location: Poland
Posts: 36
Reputation: 19
Default Re: Servers are getting attacked

Yeah, we (as a hosting company) are using such protection for quite a long time but i'm pointing to something else. Disabling query limiting at all (player packets especially) might result in bouncing huge amount of traffic - even if they're caching some reqs on tileras. This can easily trigger OVH checks and result in server suspension. I'm not going to talk about any DDoS protection anymore, because that was not my intention. This was just friendly warning about possible consequences of setting querylimit to -1.
__________________
Co-owner of the game server hosting: https://liveserver.pl/
Retired maintainer of the oldests Polish DM server: https://server-pps.com
Ubi is offline   Reply With Quote
Old 14/04/2019, 11:54 PM   #64
Mobtiesgangsa
Big Clucker
 
Mobtiesgangsa's Avatar
 
Join Date: Oct 2016
Location: The Strip
Posts: 154
Reputation: 16
Default Re: Servers are getting attacked

i had noticed it from yesterday something wasn't right with the servers i wanted to test, i closed my server noticed some wired unexpected floods.
Mobtiesgangsa is offline   Reply With Quote
Old 15/04/2019, 02:03 AM   #65
RodrigoMSR
High-roller
 
RodrigoMSR's Avatar
 
Join Date: Mar 2015
Location: Brazil
Posts: 1,075
Reputation: 140
Default Re: Servers are getting attacked

Quote:
Originally Posted by Ubi View Post
I wouldn't recommend setting it to -1 because bouncing "players" packets might generate huge outgoing traffic (reflected). Your provider (e.g. OVH) may block your server due to outgoing attack which we've experienced in the past.
So queryflood 0 won't cause my VPS to be suspended on OVH?
__________________
sttserver.net

RodrigoMSR is offline   Reply With Quote
Old 15/04/2019, 09:53 AM   #66
Leoric
Little Clucker
 
Join Date: Apr 2019
Posts: 2
Reputation: 0
Default Re: Servers are getting attacked

My server crashes as-well (linux).
Leoric is offline   Reply With Quote
Old 15/04/2019, 10:08 AM   #67
ATomas
Huge Clucker
 
Join Date: Jul 2009
Location: Czech Republic
Posts: 278
Reputation: 20
Default Re: Servers are getting attacked

Quote:
Originally Posted by xo View Post
@Ubi take a look on OVH's docs: https://us.ovhcloud.com/products/security/anti-ddos

They provide custom routines for specific game servers ( including SA:MP ) using their hardware. To analyze both incoming and outgoing packets (high outgoing traffic originally caused by UDP flood by spoofed packets? which are already filtered by their hardware based on the game server type) and their causes and start mitigating them + the packet caching they use

Though, that only exist on the game range of servers.

I got attacked not so long ago on my server for a week by the same method, switching to to a GAME firewall did the job.

Two-way mitigation: a filter on entry and exit
For every type of attack, we've built a specific response closely integrated to the servers and directly integrated within the Tilera hardware. The big innovation is a filter that analyzes the incoming and outgoing traffic to better identify legitimate requests. It's capable of distinguishing real clients connecting to the machine from harmful attacks. Anti-DDoS GAME therefore also plays the role of a cache and a filter for TCP/IP and UDP packets.


A router located next to the machine analyzes packets. This router treats every hosted game as a special case. For example, the router acts as a cache to relieve the router of useless requests.
OVH's AntiDDoS have very bug's. I have been communicating with support for 9 months to fix it. And up to 9 months to get a real result. But not perfect. I didn't want to wait another 9 months, so I leave OVH.
ATomas is offline   Reply With Quote
Old 15/04/2019, 10:08 AM   #68
MustangV10
Big Clucker
 
Join Date: Dec 2011
Posts: 67
Reputation: 26
Default Re: Servers are getting attacked

Quote:
Originally Posted by Leoric View Post
My server crashes as-well (linux).
Did you do what was suggested? What was the result?

Quote:
Originally Posted by Kalcor View Post
My server isn't crashing. It's possible servers are using a memory plugin for R2 server.

Do you know how to get a backtrace?

run the server in gdb
Code:
$ gdb samp03srv
(gdb) run
* wait for crash*
(gdb) bt
Post the log of the bt
__________________
MustangV10 is offline   Reply With Quote
Old 15/04/2019, 11:02 AM   #69
Omega16
Little Clucker
 
Join Date: Aug 2009
Posts: 4
Reputation: 0
Default Re: Servers are getting attacked

Hello. I am the owner of a small hosting company. At this point we hosts mostly game servers (in general samp server). There was a cookie attack on one of the Samp server (hosted on a vds). The attack was no more than 100 mbps and 30-40.000 pps.

There were a few moments when the server responded with delay in the samp client app, but there were no major problems.

Even if some other client said that this attack has no effect on their services, I would like to create some rules in the firewall (even iptables would be OK) so the packets wont reach the end servers.
Omega16 is offline   Reply With Quote
Old 15/04/2019, 02:21 PM   #70
Kalcor
SA-MP Developer
 
Join Date: Apr 2005
Posts: 1,180
Reputation: 2872
Default Re: Servers are getting attacked

I need a server crash report
Kalcor is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting attacked, any help? Sjn Server Support 5 30/03/2017 09:57 PM
Servers being attacked pls help me Arjanz Server Support 14 04/05/2014 08:48 AM
servers getting attacked !! cvnr0 Server Support 7 07/01/2014 02:51 PM
Bad RCON attempts - servers getting 'attacked' by the same IP Jstylezzz Server Support 18 15/05/2013 08:35 AM
Who attacked Doman Help Archive 0 28/03/2010 08:43 PM


All times are GMT. The time now is 03:16 PM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2020, Jelsoft Enterprises Ltd.