What does your server monitoring tell you? Is there a spike in traffic before/during this period?
>From a quick glance, I think it could potentially be an attack as one IP is announced from (sounds like) a compromised server (from the rDNS of the IP) in Poland, an IP from Russia (probably another server as visiting it shows Roundcube login screen, so a webmail server), and another compromised server from Argentina (again from rDNS Entry). Those port numbering are also fairly random and are probably open ports from the server's firewall. Really looks like an attack from the information presented, since I'm assuming your server isn't located near those countries (especially since most people would be playing from residential IPs, not business/corporate IPs). It looks like it's an A2S_INFO Spam attack, as described here: https://wiki.alliedmods.net/Srcds_hardening#A2S_INFO_Spam For mitigation, some suggests adding the following into the server.cfg configuration file for your server: sv_max_queries_sec_global 10 sv_max_queries_sec 5 sv_max_queries_window 10 You may or may not need to try and rate limit it via a firewall rule. Additional information available here: https://forums.alliedmods.net/showthread.php?t=271243 On Mon, Nov 16, 2015 at 5:30 PM, Παναγιώτης Φλωρούς <[email protected] > wrote: > I have the same problem and on my awp servers i dont think is from warmod > > 2015-11-15 21:46 GMT+02:00 Charalampos Galanis <[email protected]>: > >> Not pretty sure about this, but is your server running WarMod? Maybe this >> plugin needs updating >> Στις 15 Νοε 2015 21:02, ο χρήστης "ics" <[email protected]> έγραψε: >> >>> Those are propably irrelevant to the crash. It must have crashed for >>> some other reason. >>> >>> -ics >>> >>> >>> GREFFIER Jonathan kirjoitti: >>> >>>> Hello, >>>> >>>> I have one of my servers crashed, the end of the console logs: >>>> >>>> >>>> IP rate limiting client 190.0.164.107:9987 at 301 hits (15 buckets, >>>> 312 global count). >>>> IP rate limiting client 190.0.164.107:9987 at 301 hits (24 buckets, >>>> 321 global count). >>>> IP rate limiting client 190.0.164.107:9987 at 301 hits (20 buckets, >>>> 320 global count). >>>> IP rate limiting client 176.123.192.49:80 at 301 hits (17 buckets, 309 >>>> global count). >>>> IP rate limiting client 176.123.192.49:80 at 452 hits (28 buckets, 317 >>>> global count). >>>> IP rate limiting client 178.217.187.200:39548 at 301 hits (23 buckets, >>>> 338 global count). >>>> IP rate limiting client 178.217.187.200:63577 at 301 hits (26 buckets, >>>> 344 global count). >>>> IP rate limiting client 178.217.187.200:21726 at 301 hits (23 buckets, >>>> 63 global count). >>>> IP rate limiting client 178.217.187.200:42858 sustained 335 hits at >>>> 11.2 pps (21 buckets, 67 global count). >>>> >>>> >>>> someone an idea of the problem? an attack ? a configuration problem? >>>> >>>> >>>> >>>> >>>> >>>> ------------------------------------------------------------------------ >>>> Avast logo <https://www.avast.com/antivirus> >>>> >>>> L'absence de virus dans ce courrier électronique a été vérifiée par le >>>> logiciel antivirus Avast. >>>> www.avast.com <https://www.avast.com/antivirus> >>>> >>>> >>>> >>>> >>>> _______________________________________________ >>>> Csgo_servers mailing list >>>> [email protected] >>>> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers >>>> >>> >>> >>> _______________________________________________ >>> Csgo_servers mailing list >>> [email protected] >>> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers >>> >> >> _______________________________________________ >> Csgo_servers mailing list >> [email protected] >> https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers >> > > > _______________________________________________ > Csgo_servers mailing list > [email protected] > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers >
_______________________________________________ Csgo_servers mailing list [email protected] https://list.valvesoftware.com/cgi-bin/mailman/listinfo/csgo_servers
