Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Kyle Sanderson 
Just to keep this updated, he's being flooded with bad OOB packets
(Which is what ServerSecure2 helps fix).

QueryCache will not do anything in regards to this attack. To the best
of my knowledge, only ServerSecure2 will help prevent this. However,
it does have it's own downfalls such as preventing clients from
querying the server using the Server Browser if enough traffic is
going through (even legitimate traffic will cause this).

As always, sorry for my idiocy,
Kyle.

On Wed, Jan 5, 2011 at 8:49 PM, Chris Oryschak  wrote:
> Actually I was calling it a night and was going to leave the server offline, 
> decided to bring it up just to fool around about 2hrs later and it's working 
> flawless.
> I think it just had to drop all the stale/flooded packets it was receiving. 
> If I disable the plugin for a few minutes and bring it back online the 
> latency will be in the 1000ms range again and won't recover
> Just had to take the server down for 30mins-1hr again and it resumed itself 
> with normal pings.
>
> I have it up now, going see how it goes tomorrow morning but it looks to be 
> very good.
>
> Thank you very much DontWannaName and Kyle for your help!
> It's much appreciated!
>
> Chris
>
> -Original Message-
> From: hlds-boun...@list.valvesoftware.com 
> [mailto:hlds-boun...@list.valvesoftware.com] On Behalf Of Kyle Sanderson
> Sent: Wednesday, January 05, 2011 11:22 PM
> To: Half-Life dedicated Win32 server mailing list
> Subject: Re: [hlds] TF2 Server being DDoS/Exploited
>
> ServerSecure2 is causing that, which is why I fixed QueryCache.
>
> Cheers,
> Kyle.
>
> On Wed, Jan 5, 2011 at 7:00 PM, Chris  wrote:
>> Thankyou for that Kyle,
>> It helps a bit by making the server respond but with ~1300ms response time.
>>
>> You can see when i loaded the extension in my hlsw.
>>
>> http://img341.imageshack.us/img341/928/hlswm.jpg
>>
>> Anyone have any other ideas or am i dead in the water?
>>
>>
>>
>> On Wed, Jan 5, 2011 at 9:10 PM, Kyle Sanderson  wrote:
>>>
>>> Dr!fter has compiled the extension for you. Hopefully it works!
>>>
>>> Cheers,
>>> Kyle.
>>>
>>> On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
>>> > I grabbed the one from the root of that thread since that one you
>>> > linked wasn't compiled for windows... i see that was recently
>>> > updated opposed to the one on page 1.
>>> >
>>> > I requested to see if he can compile it for windows for me...
>>> >
>>> > Will wait and see...
>>> >
>>> > On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName!
>>> > 
>>> > wrote:
>>> >>
>>> >> Did you restart the server and use the version I linked to?
>>> >>
>>> >> Sent from my iPhone 4
>>> >> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>>> >>
>>> >> Ohh actually i'm getting this with the querycache extension.
>>> >>
>>> >> [03]  file "querycache.ext.dll": The specified module
>>> >> could not be found.
>>> >>
>>> >>
>>> >>
>>> >> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>>> >>>
>>> >>> Just tried it, makes the server bounce online for 1-2seconds with
>>> >>> a ping of 300 then goes to 1300 then goes down for about
>>> >>> 10seconds, does a loop.
>>> >>>
>>> >>> I tried DFENS which is a little more successful at bringing it
>>> >>> up, but still goes down just as often.
>>> >>>
>>> >>>
>>> >>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName!
>>> >>> 
>>> >>> wrote:
>>> 
>>>  If that doesn't work you could try this one:
>>> 
>>>  https://forums.alliedmods.net/showpost.php?p=1384993&postcount=4
>>>  2
>>> 
>>>  On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>>> >
>>> > My server is under attack from a DDoS/Exploit.
>>> >
>>> > The server is still online and responds to simple pings no
>>> > problem, but any traffic going to port 27015 is shut down.
>>> >
>>> > I’ve been doing research and came across a plugin called
>>> > “ServerSecure2” (URL:
>>> > https://forums.alliedmods.net/showthread.php?t=135679
>>> > )
>>> >
>>> > Which has semi-fixed the exploit I’m being hit with.
>>> >
>>> >
>>> >
>>> > The server responds instantly for all rcon requests, no time
>>> > outs in that department once I have that plugin running.
>>> >
>>> > But users can still not connect to the server, use HLSW to get
>>> > it’s status (shows server is timing out)
>>> >
>>> >
>>> >
>>> >
>>> >
>>> > Anyone have any ideas/suggestions on resolving this?
>>> >
>>> > Note: It’s a windows rented server and I don’t have remote
>>> > access to it, just FTP / Web Control Panel.
>>> >
>>> >
>>> >
>>> > Thanks,
>>> >
>>> > Chris
>>> >
>>> > ___
>>> > To unsubscribe, edit your list preferences, or view the list
>>> > archives, please visit:
>>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>>> >
>>> 
>>> 
>>>  ___
>>>  To unsubscribe, edit your list

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris Oryschak 
Actually I was calling it a night and was going to leave the server offline, 
decided to bring it up just to fool around about 2hrs later and it's working 
flawless.
I think it just had to drop all the stale/flooded packets it was receiving. If 
I disable the plugin for a few minutes and bring it back online the latency 
will be in the 1000ms range again and won't recover
Just had to take the server down for 30mins-1hr again and it resumed itself 
with normal pings.

I have it up now, going see how it goes tomorrow morning but it looks to be 
very good.

Thank you very much DontWannaName and Kyle for your help!
It's much appreciated!

Chris

-Original Message-
From: hlds-boun...@list.valvesoftware.com 
[mailto:hlds-boun...@list.valvesoftware.com] On Behalf Of Kyle Sanderson
Sent: Wednesday, January 05, 2011 11:22 PM
To: Half-Life dedicated Win32 server mailing list
Subject: Re: [hlds] TF2 Server being DDoS/Exploited

ServerSecure2 is causing that, which is why I fixed QueryCache.

Cheers,
Kyle.

On Wed, Jan 5, 2011 at 7:00 PM, Chris  wrote:
> Thankyou for that Kyle,
> It helps a bit by making the server respond but with ~1300ms response time.
>
> You can see when i loaded the extension in my hlsw.
>
> http://img341.imageshack.us/img341/928/hlswm.jpg
>
> Anyone have any other ideas or am i dead in the water?
>
>
>
> On Wed, Jan 5, 2011 at 9:10 PM, Kyle Sanderson  wrote:
>>
>> Dr!fter has compiled the extension for you. Hopefully it works!
>>
>> Cheers,
>> Kyle.
>>
>> On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
>> > I grabbed the one from the root of that thread since that one you 
>> > linked wasn't compiled for windows... i see that was recently 
>> > updated opposed to the one on page 1.
>> >
>> > I requested to see if he can compile it for windows for me...
>> >
>> > Will wait and see...
>> >
>> > On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! 
>> > 
>> > wrote:
>> >>
>> >> Did you restart the server and use the version I linked to?
>> >>
>> >> Sent from my iPhone 4
>> >> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>> >>
>> >> Ohh actually i'm getting this with the querycache extension.
>> >>
>> >> [03]  file "querycache.ext.dll": The specified module 
>> >> could not be found.
>> >>
>> >>
>> >>
>> >> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>> >>>
>> >>> Just tried it, makes the server bounce online for 1-2seconds with 
>> >>> a ping of 300 then goes to 1300 then goes down for about 
>> >>> 10seconds, does a loop.
>> >>>
>> >>> I tried DFENS which is a little more successful at bringing it 
>> >>> up, but still goes down just as often.
>> >>>
>> >>>
>> >>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName!
>> >>> 
>> >>> wrote:
>> 
>>  If that doesn't work you could try this one:
>> 
>>  https://forums.alliedmods.net/showpost.php?p=1384993&postcount=4
>>  2
>> 
>>  On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>> >
>> > My server is under attack from a DDoS/Exploit.
>> >
>> > The server is still online and responds to simple pings no 
>> > problem, but any traffic going to port 27015 is shut down.
>> >
>> > I’ve been doing research and came across a plugin called 
>> > “ServerSecure2” (URL:
>> > https://forums.alliedmods.net/showthread.php?t=135679
>> > )
>> >
>> > Which has semi-fixed the exploit I’m being hit with.
>> >
>> >
>> >
>> > The server responds instantly for all rcon requests, no time 
>> > outs in that department once I have that plugin running.
>> >
>> > But users can still not connect to the server, use HLSW to get 
>> > it’s status (shows server is timing out)
>> >
>> >
>> >
>> >
>> >
>> > Anyone have any ideas/suggestions on resolving this?
>> >
>> > Note: It’s a windows rented server and I don’t have remote 
>> > access to it, just FTP / Web Control Panel.
>> >
>> >
>> >
>> > Thanks,
>> >
>> > Chris
>> >
>> > ___
>> > To unsubscribe, edit your list preferences, or view the list 
>> > archives, please visit:
>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>> >
>> 
>> 
>>  ___
>>  To unsubscribe, edit your list preferences, or view the list
>>  archives,
>>  please visit:
>>  http://list.valvesoftware.com/mailman/listinfo/hlds
>> 
>> >>>
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >
>> >
>> > ___
>> > To unsubscribe, edit your lis

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Kyle Sanderson 
ServerSecure2 is causing that, which is why I fixed QueryCache.

Cheers,
Kyle.

On Wed, Jan 5, 2011 at 7:00 PM, Chris  wrote:
> Thankyou for that Kyle,
> It helps a bit by making the server respond but with ~1300ms response time.
>
> You can see when i loaded the extension in my hlsw.
>
> http://img341.imageshack.us/img341/928/hlswm.jpg
>
> Anyone have any other ideas or am i dead in the water?
>
>
>
> On Wed, Jan 5, 2011 at 9:10 PM, Kyle Sanderson  wrote:
>>
>> Dr!fter has compiled the extension for you. Hopefully it works!
>>
>> Cheers,
>> Kyle.
>>
>> On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
>> > I grabbed the one from the root of that thread since that one you linked
>> > wasn't compiled for windows... i see that was recently updated opposed
>> > to
>> > the one on page 1.
>> >
>> > I requested to see if he can compile it for windows for me...
>> >
>> > Will wait and see...
>> >
>> > On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! 
>> > wrote:
>> >>
>> >> Did you restart the server and use the version I linked to?
>> >>
>> >> Sent from my iPhone 4
>> >> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>> >>
>> >> Ohh actually i'm getting this with the querycache extension.
>> >>
>> >> [03]  file "querycache.ext.dll": The specified module could not
>> >> be
>> >> found.
>> >>
>> >>
>> >>
>> >> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>> >>>
>> >>> Just tried it, makes the server bounce online for 1-2seconds with a
>> >>> ping
>> >>> of 300 then goes to 1300 then goes down for about 10seconds, does a
>> >>> loop.
>> >>>
>> >>> I tried DFENS which is a little more successful at bringing it up, but
>> >>> still goes down just as often.
>> >>>
>> >>>
>> >>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName!
>> >>> 
>> >>> wrote:
>> 
>>  If that doesn't work you could try this one:
>> 
>>  https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
>> 
>>  On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>> >
>> > My server is under attack from a DDoS/Exploit.
>> >
>> > The server is still online and responds to simple pings no problem,
>> > but
>> > any traffic going to port 27015 is shut down.
>> >
>> > I’ve been doing research and came across a plugin called
>> > “ServerSecure2” (URL:
>> > https://forums.alliedmods.net/showthread.php?t=135679
>> > )
>> >
>> > Which has semi-fixed the exploit I’m being hit with.
>> >
>> >
>> >
>> > The server responds instantly for all rcon requests, no time outs in
>> > that department once I have that plugin running.
>> >
>> > But users can still not connect to the server, use HLSW to get it’s
>> > status (shows server is timing out)
>> >
>> >
>> >
>> >
>> >
>> > Anyone have any ideas/suggestions on resolving this?
>> >
>> > Note: It’s a windows rented server and I don’t have remote access to
>> > it, just FTP / Web Control Panel.
>> >
>> >
>> >
>> > Thanks,
>> >
>> > Chris
>> >
>> > ___
>> > To unsubscribe, edit your list preferences, or view the list
>> > archives,
>> > please visit:
>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>> >
>> 
>> 
>>  ___
>>  To unsubscribe, edit your list preferences, or view the list
>>  archives,
>>  please visit:
>>  http://list.valvesoftware.com/mailman/listinfo/hlds
>> 
>> >>>
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >
>> >
>> > ___
>> > To unsubscribe, edit your list preferences, or view the list archives,
>> > please visit:
>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>> >
>> >
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>

___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread DarthNinja 
I was getting a DoS attack from some jerk a while ago.  It was causing the
server to go to a really high ping then crash/restart.
Installing Tony's DAF fixed it.  No idea if it's still needed or if it would
help, but its worth a shot:
http://www.sourceop.com/modules.php?name=Downloads&d_op=viewdownload&cid=9



On Wed, Jan 5, 2011 at 10:00 PM, Chris  wrote:

> Thankyou for that Kyle,
> It helps a bit by making the server respond but with ~1300ms response time.
>
> You can see when i loaded the extension in my hlsw.
>
> http://img341.imageshack.us/img341/928/hlswm.jpg
>
> Anyone have any other ideas or am i dead in the water?
>
>
>
>
> On Wed, Jan 5, 2011 at 9:10 PM, Kyle Sanderson wrote:
>
>> Dr!fter has compiled the extension for you. Hopefully it works!
>>
>> Cheers,
>> Kyle.
>>
>> On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
>> > I grabbed the one from the root of that thread since that one you linked
>> > wasn't compiled for windows... i see that was recently updated opposed
>> to
>> > the one on page 1.
>> >
>> > I requested to see if he can compile it for windows for me...
>> >
>> > Will wait and see...
>> >
>> > On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! 
>> > wrote:
>> >>
>> >> Did you restart the server and use the version I linked to?
>> >>
>> >> Sent from my iPhone 4
>> >> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>> >>
>> >> Ohh actually i'm getting this with the querycache extension.
>> >>
>> >> [03]  file "querycache.ext.dll": The specified module could not
>> be
>> >> found.
>> >>
>> >>
>> >>
>> >> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>> >>>
>> >>> Just tried it, makes the server bounce online for 1-2seconds with a
>> ping
>> >>> of 300 then goes to 1300 then goes down for about 10seconds, does a
>> loop.
>> >>>
>> >>> I tried DFENS which is a little more successful at bringing it up, but
>> >>> still goes down just as often.
>> >>>
>> >>>
>> >>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName! <
>> ad...@topnotchclan.com>
>> >>> wrote:
>> 
>>  If that doesn't work you could try this one:
>> 
>>  https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
>> 
>>  On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>> >
>> > My server is under attack from a DDoS/Exploit.
>> >
>> > The server is still online and responds to simple pings no problem,
>> but
>> > any traffic going to port 27015 is shut down.
>> >
>> > I�ve been doing research and came across a plugin called
>> > �ServerSecure2� (URL:
>> https://forums.alliedmods.net/showthread.php?t=135679
>> > )
>> >
>> > Which has semi-fixed the exploit I�m being hit with.
>> >
>> >
>> >
>> > The server responds instantly for all rcon requests, no time outs in
>> > that department once I have that plugin running.
>> >
>> > But users can still not connect to the server, use HLSW to get it�s
>> > status (shows server is timing out)
>> >
>> >
>> >
>> >
>> >
>> > Anyone have any ideas/suggestions on resolving this?
>> >
>> > Note: It�s a windows rented server and I don�t have remote access to
>> > it, just FTP / Web Control Panel.
>> >
>> >
>> >
>> > Thanks,
>> >
>> > Chris
>> >
>> > ___
>> > To unsubscribe, edit your list preferences, or view the list
>> archives,
>> > please visit:
>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>> >
>> 
>> 
>>  ___
>>  To unsubscribe, edit your list preferences, or view the list
>> archives,
>>  please visit:
>>  http://list.valvesoftware.com/mailman/listinfo/hlds
>> 
>> >>>
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >> ___
>> >> To unsubscribe, edit your list preferences, or view the list archives,
>> >> please visit:
>> >> http://list.valvesoftware.com/mailman/listinfo/hlds
>> >>
>> >
>> >
>> > ___
>> > To unsubscribe, edit your list preferences, or view the list archives,
>> > please visit:
>> > http://list.valvesoftware.com/mailman/listinfo/hlds
>> >
>> >
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>
>
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>


-- 
~DarthNinja
*http://www.DarthNinja.com 
http://www.GoRClan.com *
___
To uns

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris 
Thankyou for that Kyle,
It helps a bit by making the server respond but with ~1300ms response time.

You can see when i loaded the extension in my hlsw.

http://img341.imageshack.us/img341/928/hlswm.jpg

Anyone have any other ideas or am i dead in the water?




On Wed, Jan 5, 2011 at 9:10 PM, Kyle Sanderson  wrote:

> Dr!fter has compiled the extension for you. Hopefully it works!
>
> Cheers,
> Kyle.
>
> On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
> > I grabbed the one from the root of that thread since that one you linked
> > wasn't compiled for windows... i see that was recently updated opposed to
> > the one on page 1.
> >
> > I requested to see if he can compile it for windows for me...
> >
> > Will wait and see...
> >
> > On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! 
> > wrote:
> >>
> >> Did you restart the server and use the version I linked to?
> >>
> >> Sent from my iPhone 4
> >> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
> >>
> >> Ohh actually i'm getting this with the querycache extension.
> >>
> >> [03]  file "querycache.ext.dll": The specified module could not
> be
> >> found.
> >>
> >>
> >>
> >> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
> >>>
> >>> Just tried it, makes the server bounce online for 1-2seconds with a
> ping
> >>> of 300 then goes to 1300 then goes down for about 10seconds, does a
> loop.
> >>>
> >>> I tried DFENS which is a little more successful at bringing it up, but
> >>> still goes down just as often.
> >>>
> >>>
> >>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName!  >
> >>> wrote:
> 
>  If that doesn't work you could try this one:
> 
>  https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
> 
>  On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
> >
> > My server is under attack from a DDoS/Exploit.
> >
> > The server is still online and responds to simple pings no problem,
> but
> > any traffic going to port 27015 is shut down.
> >
> > I’ve been doing research and came across a plugin called
> > “ServerSecure2” (URL:
> https://forums.alliedmods.net/showthread.php?t=135679
> > )
> >
> > Which has semi-fixed the exploit I’m being hit with.
> >
> >
> >
> > The server responds instantly for all rcon requests, no time outs in
> > that department once I have that plugin running.
> >
> > But users can still not connect to the server, use HLSW to get it’s
> > status (shows server is timing out)
> >
> >
> >
> >
> >
> > Anyone have any ideas/suggestions on resolving this?
> >
> > Note: It’s a windows rented server and I don’t have remote access to
> > it, just FTP / Web Control Panel.
> >
> >
> >
> > Thanks,
> >
> > Chris
> >
> > ___
> > To unsubscribe, edit your list preferences, or view the list
> archives,
> > please visit:
> > http://list.valvesoftware.com/mailman/listinfo/hlds
> >
> 
> 
>  ___
>  To unsubscribe, edit your list preferences, or view the list archives,
>  please visit:
>  http://list.valvesoftware.com/mailman/listinfo/hlds
> 
> >>>
> >>
> >> ___
> >> To unsubscribe, edit your list preferences, or view the list archives,
> >> please visit:
> >> http://list.valvesoftware.com/mailman/listinfo/hlds
> >>
> >> ___
> >> To unsubscribe, edit your list preferences, or view the list archives,
> >> please visit:
> >> http://list.valvesoftware.com/mailman/listinfo/hlds
> >>
> >
> >
> > ___
> > To unsubscribe, edit your list preferences, or view the list archives,
> > please visit:
> > http://list.valvesoftware.com/mailman/listinfo/hlds
> >
> >
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Kyle Sanderson 
Dr!fter has compiled the extension for you. Hopefully it works!

Cheers,
Kyle.

On Wed, Jan 5, 2011 at 12:50 PM, Chris  wrote:
> I grabbed the one from the root of that thread since that one you linked
> wasn't compiled for windows... i see that was recently updated opposed to
> the one on page 1.
>
> I requested to see if he can compile it for windows for me...
>
> Will wait and see...
>
> On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! 
> wrote:
>>
>> Did you restart the server and use the version I linked to?
>>
>> Sent from my iPhone 4
>> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>>
>> Ohh actually i'm getting this with the querycache extension.
>>
>> [03]  file "querycache.ext.dll": The specified module could not be
>> found.
>>
>>
>>
>> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>>>
>>> Just tried it, makes the server bounce online for 1-2seconds with a ping
>>> of 300 then goes to 1300 then goes down for about 10seconds, does a loop.
>>>
>>> I tried DFENS which is a little more successful at bringing it up, but
>>> still goes down just as often.
>>>
>>>
>>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName! 
>>> wrote:

 If that doesn't work you could try this one:

 https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42

 On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>
> My server is under attack from a DDoS/Exploit.
>
> The server is still online and responds to simple pings no problem, but
> any traffic going to port 27015 is shut down.
>
> I’ve been doing research and came across a plugin called
> “ServerSecure2” (URL: 
> https://forums.alliedmods.net/showthread.php?t=135679
> )
>
> Which has semi-fixed the exploit I’m being hit with.
>
>
>
> The server responds instantly for all rcon requests, no time outs in
> that department once I have that plugin running.
>
> But users can still not connect to the server, use HLSW to get it’s
> status (shows server is timing out)
>
>
>
>
>
> Anyone have any ideas/suggestions on resolving this?
>
> Note: It’s a windows rented server and I don’t have remote access to
> it, just FTP / Web Control Panel.
>
>
>
> Thanks,
>
> Chris
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>


 ___
 To unsubscribe, edit your list preferences, or view the list archives,
 please visit:
 http://list.valvesoftware.com/mailman/listinfo/hlds

>>>
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>
>
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>

___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris 
I grabbed the one from the root of that thread since that one you linked
wasn't compiled for windows... i see that was recently updated opposed to
the one on page 1.

I requested to see if he can compile it for windows for me...

Will wait and see...

On Wed, Jan 5, 2011 at 3:41 PM, DontWannaName! wrote:

>  Did you restart the server and use the version I linked to?
>
> Sent from my iPhone 4
>
> On Jan 5, 2011, at 12:07 PM, Chris  wrote:
>
>   Ohh actually i'm getting this with the querycache extension.
>
> [03]  file "querycache.ext.dll": The specified module could not be
> found.
>
>
>
>
> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
>
>> Just tried it, makes the server bounce online for 1-2seconds with a ping
>> of 300 then goes to 1300 then goes down for about 10seconds, does a loop.
>>
>> I tried DFENS which is a little more successful at bringing it up, but
>> still goes down just as often.
>>
>>
>>
>> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName! wrote:
>>
>>> If that doesn't work you could try this one:
>>>
>>> https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
>>>
>>>   On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>>>
   My server is under attack from a DDoS/Exploit.

 The server is still online and responds to simple pings no problem, but
 any traffic going to port 27015 is shut down.

 I’ve been doing research and came across a plugin called “ServerSecure2”
 (URL: https://forums.alliedmods.net/showthread.php?t=135679 )

 Which has semi-fixed the exploit I’m being hit with.



 The server responds instantly for all rcon requests, no time outs in
 that department once I have that plugin running.

 But users can still not connect to the server, use HLSW to get it’s
 status (shows server is timing out)





 Anyone have any ideas/suggestions on resolving this?

 Note: It’s a windows rented server and I don’t have remote access to it,
 just FTP / Web Control Panel.



 Thanks,

 Chris

 ___
 To unsubscribe, edit your list preferences, or view the list archives,
 please visit:
 http://list.valvesoftware.com/mailman/listinfo/hlds


>>>
>>> ___
>>> To unsubscribe, edit your list preferences, or view the list archives,
>>> please visit:
>>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>>
>>>
>>
>  ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread DontWannaName! 
Did you restart the server and use the version I linked to?

Sent from my iPhone 4

On Jan 5, 2011, at 12:07 PM, Chris  wrote:

> Ohh actually i'm getting this with the querycache extension.
>  
> [03]  file "querycache.ext.dll": The specified module could not be 
> found.
>  
> 
> 
>  
> On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:
> Just tried it, makes the server bounce online for 1-2seconds with a ping of 
> 300 then goes to 1300 then goes down for about 10seconds, does a loop.
>  
> I tried DFENS which is a little more successful at bringing it up, but still 
> goes down just as often.
> 
> 
>  
> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName!  wrote:
> If that doesn't work you could try this one:
>  
> https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
> 
> On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
> My server is under attack from a DDoS/Exploit.
> The server is still online and responds to simple pings no problem, but any 
> traffic going to port 27015 is shut down.
> I’ve been doing research and came across a plugin called “ServerSecure2” 
> (URL: https://forums.alliedmods.net/showthread.php?t=135679 )
> Which has semi-fixed the exploit I’m being hit with.
>  
> The server responds instantly for all rcon requests, no time outs in that 
> department once I have that plugin running.
> But users can still not connect to the server, use HLSW to get it’s status 
> (shows server is timing out)
>  
>  
> Anyone have any ideas/suggestions on resolving this?
> Note: It’s a windows rented server and I don’t have remote access to it, just 
> FTP / Web Control Panel.
>  
> Thanks,
> Chris
> 
> ___
> To unsubscribe, edit your list preferences, or view the list archives, please 
> visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
> 
> 
> 
> ___
> To unsubscribe, edit your list preferences, or view the list archives, please 
> visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
> 
> 
> 
> ___
> To unsubscribe, edit your list preferences, or view the list archives, please 
> visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris 
Ohh actually i'm getting this with the querycache extension.

[03]  file "querycache.ext.dll": The specified module could not be
found.




On Wed, Jan 5, 2011 at 2:54 PM, Chris  wrote:

> Just tried it, makes the server bounce online for 1-2seconds with a ping of
> 300 then goes to 1300 then goes down for about 10seconds, does a loop.
>
> I tried DFENS which is a little more successful at bringing it up, but
> still goes down just as often.
>
>
>
> On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName! wrote:
>
>> If that doesn't work you could try this one:
>>
>> https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
>>
>>   On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>>
>>>   My server is under attack from a DDoS/Exploit.
>>>
>>> The server is still online and responds to simple pings no problem, but
>>> any traffic going to port 27015 is shut down.
>>>
>>> I’ve been doing research and came across a plugin called “ServerSecure2”
>>> (URL: https://forums.alliedmods.net/showthread.php?t=135679 )
>>>
>>> Which has semi-fixed the exploit I’m being hit with.
>>>
>>>
>>>
>>> The server responds instantly for all rcon requests, no time outs in that
>>> department once I have that plugin running.
>>>
>>> But users can still not connect to the server, use HLSW to get it’s
>>> status (shows server is timing out)
>>>
>>>
>>>
>>>
>>>
>>> Anyone have any ideas/suggestions on resolving this?
>>>
>>> Note: It’s a windows rented server and I don’t have remote access to it,
>>> just FTP / Web Control Panel.
>>>
>>>
>>>
>>> Thanks,
>>>
>>> Chris
>>>
>>> ___
>>> To unsubscribe, edit your list preferences, or view the list archives,
>>> please visit:
>>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>>
>>>
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>
>>
>
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris 
Just tried it, makes the server bounce online for 1-2seconds with a ping of
300 then goes to 1300 then goes down for about 10seconds, does a loop.

I tried DFENS which is a little more successful at bringing it up, but still
goes down just as often.



On Wed, Jan 5, 2011 at 2:36 PM, DontWannaName! wrote:

> If that doesn't work you could try this one:
>
> https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42
>
>   On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:
>
>>   My server is under attack from a DDoS/Exploit.
>>
>> The server is still online and responds to simple pings no problem, but
>> any traffic going to port 27015 is shut down.
>>
>> I’ve been doing research and came across a plugin called “ServerSecure2”
>> (URL: https://forums.alliedmods.net/showthread.php?t=135679 )
>>
>> Which has semi-fixed the exploit I’m being hit with.
>>
>>
>>
>> The server responds instantly for all rcon requests, no time outs in that
>> department once I have that plugin running.
>>
>> But users can still not connect to the server, use HLSW to get it’s status
>> (shows server is timing out)
>>
>>
>>
>>
>>
>> Anyone have any ideas/suggestions on resolving this?
>>
>> Note: It’s a windows rented server and I don’t have remote access to it,
>> just FTP / Web Control Panel.
>>
>>
>>
>> Thanks,
>>
>> Chris
>>
>> ___
>> To unsubscribe, edit your list preferences, or view the list archives,
>> please visit:
>> http://list.valvesoftware.com/mailman/listinfo/hlds
>>
>>
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread DontWannaName! 
If that doesn't work you could try this one:

https://forums.alliedmods.net/showpost.php?p=1384993&postcount=42

On Wed, Jan 5, 2011 at 11:30 AM, Chris  wrote:

> My server is under attack from a DDoS/Exploit.
>
> The server is still online and responds to simple pings no problem, but any
> traffic going to port 27015 is shut down.
>
> I’ve been doing research and came across a plugin called “ServerSecure2”
> (URL: https://forums.alliedmods.net/showthread.php?t=135679 )
>
> Which has semi-fixed the exploit I’m being hit with.
>
>
>
> The server responds instantly for all rcon requests, no time outs in that
> department once I have that plugin running.
>
> But users can still not connect to the server, use HLSW to get it’s status
> (shows server is timing out)
>
>
>
>
>
> Anyone have any ideas/suggestions on resolving this?
>
> Note: It’s a windows rented server and I don’t have remote access to it,
> just FTP / Web Control Panel.
>
>
>
> Thanks,
>
> Chris
>
> ___
> To unsubscribe, edit your list preferences, or view the list archives,
> please visit:
> http://list.valvesoftware.com/mailman/listinfo/hlds
>
>
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

[hlds] TF2 Server being DDoS/Exploited

2011-01-05 Thread Chris 
My server is under attack from a DDoS/Exploit.

The server is still online and responds to simple pings no problem, but any
traffic going to port 27015 is shut down.

I’ve been doing research and came across a plugin called “ServerSecure2”
(URL: https://forums.alliedmods.net/showthread.php?t=135679 )

Which has semi-fixed the exploit I’m being hit with.



The server responds instantly for all rcon requests, no time outs in that
department once I have that plugin running.

But users can still not connect to the server, use HLSW to get it’s status
(shows server is timing out)





Anyone have any ideas/suggestions on resolving this?

Note: It’s a windows rented server and I don’t have remote access to it,
just FTP / Web Control Panel.



Thanks,

Chris
___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

[hlds] Required Update for Killing Floor

2011-01-05 Thread Dayle Flowers 
A required update for Killing Floor has just been released.  You will 
need to update your servers in order to remain compatible with clients. 
 This update turns off the Christmas mode and fixes some exploits on a 
few official maps.

--
Cheers,
Dayle Flowers
Senior Programmer
Tripwire Interactive, LLC.

___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] engine.dll crashes, dumps for VALVE

2011-01-05 Thread Dominik Friedrichs 
Well I just tried the test case for a few minutes, but I couldnt get the 
server to crash at all, maybe thats a different issue then and maybe just 
for Linux...


- Original Message - 
From: "Kyle Sanderson" 
To: "Dominik Friedrichs" ; "Half-Life dedicated Win32 server 
mailing list" 

Sent: Wednesday, January 05, 2011 01:02
Subject: Re: [hlds] engine.dll crashes, dumps for VALVE



Sorry if you just wanted Valve to look at these. However, from what
the mdmp is saying (and if I'm understanding it correctly) is the
engine jumped to a null location. Since there are absolutely no null
checks before a jump occurs (sorry if I'm using incorrect terminology,
as well), the server will crash. This is what happened in
CSS_crash_srcds.exe_20110104132753_1.dmp,
TF2_crash_srcds.exe_20110101130045_1.dmp, and
TF2_crash_srcds.exe_20110102154253_1.dmp (only ones I've looked at).
Again, this is only valid if I'm understanding the dump correctly,
it's trying to jump to 0x000.

I filed a bug on AM a while ago, foolishly thinking it was an issue
with SDKTools. To keep this brief, it wasn't.

For reference, here's the bug that I filed:
https://bugs.alliedmods.net/show_bug.cgi?id=4767

There's a SourcePawn test case there that will crash SRCDS (CS:S) near
flawlessly every time.

I hope this helps, crashes absolutely suck. I can reproduce at least
one server freeze on Linux (101% CPU is just delightful), if anyone
wants to seriously look into this. I also hope I wasn't incorrect, and
sent this potentially misinformation filled mail out.
Kyle.


On Tue, Jan 4, 2011 at 8:15 AM, Dominik Friedrichs  wrote:

Hey Valve!

How about fixing these engine.dll crashes that happen almost daily on my
servers:

http://forlix.org/_res/host/dumps/

Sadly there is another crash with CSS that hangs the server and doesnt
generate a dump, but fixing the above would still be great.


___
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds







___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds

Re: [hlds] engine.dll crashes, dumps for VALVE

2011-01-05 Thread Dominik Friedrichs 

Well for the CS:S one I get
CSS_crash_srcds.exe_20110104132753_1.dmp: 0xC005: Access violation
reading location 0x0b5d5626.
Thats not really a null pointer, neither are the others as far as I
remember.
But thanks for pointing to the RemoveEdict issue, I will take a closer look
at that, I'm using it in CS:S to remove ragdolls (and not even sure they
have a kill input as alternative method) but I dont think I'm using it in
TF2 at all.

Mostly the crashes happen when someone enters the game, therefore often
after mapchange when a lot of people do that. The strange thing is, other
people are using my plugins on Linux and do not have these crashes so its
kind of a Windows issue only.

- Original Message - 
From: "Kyle Sanderson" 
To: "Dominik Friedrichs" ; "Half-Life dedicated Win32 server 
mailing list" 

Sent: Wednesday, January 05, 2011 01:02
Subject: Re: [hlds] engine.dll crashes, dumps for VALVE



Sorry if you just wanted Valve to look at these. However, from what
the mdmp is saying (and if I'm understanding it correctly) is the
engine jumped to a null location. Since there are absolutely no null
checks before a jump occurs (sorry if I'm using incorrect terminology,
as well), the server will crash. This is what happened in
CSS_crash_srcds.exe_20110104132753_1.dmp,
TF2_crash_srcds.exe_20110101130045_1.dmp, and
TF2_crash_srcds.exe_20110102154253_1.dmp (only ones I've looked at).
Again, this is only valid if I'm understanding the dump correctly,
it's trying to jump to 0x000.

I filed a bug on AM a while ago, foolishly thinking it was an issue
with SDKTools. To keep this brief, it wasn't.

For reference, here's the bug that I filed:
https://bugs.alliedmods.net/show_bug.cgi?id=4767

There's a SourcePawn test case there that will crash SRCDS (CS:S) near
flawlessly every time.

I hope this helps, crashes absolutely suck. I can reproduce at least
one server freeze on Linux (101% CPU is just delightful), if anyone
wants to seriously look into this. I also hope I wasn't incorrect, and
sent this potentially misinformation filled mail out.
Kyle.


On Tue, Jan 4, 2011 at 8:15 AM, Dominik Friedrichs  wrote:

Hey Valve!

How about fixing these engine.dll crashes that happen almost daily on my
servers:

http://forlix.org/_res/host/dumps/

Sadly there is another crash with CSS that hangs the server and doesnt
generate a dump, but fixing the above would still be great.


___
To unsubscribe, edit your list preferences, or view the list archives,
please visit:
http://list.valvesoftware.com/mailman/listinfo/hlds







___
To unsubscribe, edit your list preferences, or view the list archives, please 
visit:
http://list.valvesoftware.com/mailman/listinfo/hlds