Re: [hlds_linux] Email Archive

2012-11-27 Thread Dan Offord
There is also: http://www.mail-archive.com/hlds_linux@list.valvesoftware.com/ Which has a search feature is indexed by google. Regards, Dan On 27 November 2012 03:29, Jesse Molina je...@opendreams.net wrote: Neither are good solutions. The official private list is not indexed by search

[hlds_linux] Incoming DoS attack

2012-11-27 Thread Saint K .
Hi, We've been having DoS attacks aimed at one of our MvM servers. Anyone have any idea what they're attempting to do here? It is just to make the server unreachable, or are the actually trying to exploit srcds somehow? Here's a tcpdump made for about 30 seconds during the attack (which is

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Michael Johansen
I haven't looked at the tcpdump, but I have been getting attacks too, they're SYN floods, 300 - 400 mbps in size and always coming from local/reserved (0.x) ip's. All started soem time after we set up our mvm serves. From: sai...@specialattack.net To: hlds_linux@list.valvesoftware.com Date:

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Saint K .
The IP's in the dump originate from China, but as it's UDP it could very well be spoofed. Looking at the payload in the packets, each new packet only has 1 character change from the previous packet. Bruteforce, or perhaps signature scanning evasion? Saint K.

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Michael Johansen
Just took a look at the tcpdump, doesn't look like the attacks I'm having. I may be stupid now, but wouldn't it work just by blocking packets with the size of 50? From: sai...@specialattack.net To: hlds_linux@list.valvesoftware.com Date: Tue, 27 Nov 2012 11:19:08 +0100 Subject: Re:

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Saint K .
We have no control over the upstream network. All I can do is filter the packets at the machine, but that wouldn't prevent the link from still being overloaded. Currently a null-route is in place to stop the attack at the network boarder. Saint K. From:

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Michael Johansen
My face when, I just analyzed my own tcpdump and I had over ~150 Mbit/s traffic on UDP, where as my SYN stood for about 50k pps. From: sai...@specialattack.net To: hlds_linux@list.valvesoftware.com Date: Tue, 27 Nov 2012 11:29:01 +0100 Subject: Re: [hlds_linux] Incoming DoS attack We

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Marco Padovan
Hi, are you the Mike on WHT? I was the one replying in there :D Il 27/11/2012 13.54, Michael Johansen ha scritto: My face when, I just analyzed my own tcpdump and I had over ~150 Mbit/s traffic on UDP, where as my SYN stood for about 50k pps. From: sai...@specialattack.net To:

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Michael Johansen
I am indeed. Thank you for all your help :) Date: Tue, 27 Nov 2012 14:25:24 +0100 From: e...@evcz.tk To: hlds_linux@list.valvesoftware.com Subject: Re: [hlds_linux] Incoming DoS attack Hi, are you the Mike on WHT? I was the one replying in there :D Il 27/11/2012 13.54, Michael

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Saint K .
The what, on the what? From: hlds_linux-boun...@list.valvesoftware.com [hlds_linux-boun...@list.valvesoftware.com] On Behalf Of Marco Padovan [e...@evcz.tk] Sent: 27 November 2012 14:25 To: hlds_linux@list.valvesoftware.com Subject: Re: [hlds_linux]

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Marco Padovan
ihih, nice :) the most important thing while being ddosed is to report to the relevant abuse desks so they can clean up their networks ;) Il 27/11/2012 14.26, Michael Johansen ha scritto: I am indeed. Thank you for all your help :) Date: Tue, 27 Nov 2012 14:25:24 +0100 From: e...@evcz.tk

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Saint K .
That's kind of pointless in case of UDP attacks, chances are very high that the IP's simply are spoofed. Saint K. From: hlds_linux-boun...@list.valvesoftware.com [hlds_linux-boun...@list.valvesoftware.com] On Behalf Of Marco Padovan [e...@evcz.tk] Sent:

Re: [hlds_linux] Incoming DoS attack

2012-11-27 Thread Marco Padovan
when you have fat pipes (1gbit or 10gbit uplinks) people need fatpipes too to spooffrom and take you down... but, IIRC, that well knonw .EU isp that allows spoofing let people do that only on the 100mbit network no on the gbit network. Therefore here comes the amplification (mostly DNS (udp 53)

Re: [hlds_linux] Other FastDL formats

2012-11-27 Thread Andre Müller
No, only bzip2 There was already a request for lzma in the cs:go mailinglist 2012/11/27 Nomaan Ahmad n0man@gmail.com I don't think so. On 27 November 2012 02:03, Cameron Munroe cmun...@cameronmunroe.com wrote: Is there another format you can use for fast download servers.

Re: [hlds_linux] Other FastDL formats

2012-11-27 Thread Cameron Munroe
That is what I thought, another format would be really nice. On , Andre Müller wrote: No, only bzip2 There was already a request for lzma in the cs:go mailinglist 2012/11/27 Nomaan Ahmad n0man@gmail.com I don't think so. On 27 November 2012 02:03, Cameron Munroe

Re: [hlds_linux] Other FastDL formats

2012-11-27 Thread ics
Perhaps on Source2 this might happen but not in current branch. -ics 27.11.2012 18:02, Cameron Munroe kirjoitti: That is what I thought, another format would be really nice. On , Andre Müller wrote: No, only bzip2 There was already a request for lzma in the cs:go mailinglist

Re: [hlds_linux] Other FastDL formats

2012-11-27 Thread Cameron Munroe
The real question at that point is will source2 be used in TF2? On , ics wrote: Perhaps on Source2 this might happen but not in current branch. -ics 27.11.2012 18:02, Cameron Munroe kirjoitti: That is what I thought, another format would be really nice. On , Andre Müller wrote:

Re: [hlds_linux] Other FastDL formats

2012-11-27 Thread ics
Personally i would not like that to happen, unless the porting is more successfull than when Dod:Source and CS Source were to OrangeBox. There was that message year or so ago where Valve said they will be getting rid of .gcf format due to it's issues on TF2 and other Valve games but that