Nemu's Stomping Ground was also targetted around this time. It sounds like it may just be a generic DDoS someone was throwing around as all the traffic was inbound. I'm going for some burgers (mmm...) but I'll setup some packet monitoring when I get back to see whats going on if it happens again.
- Neph On Sun, Apr 20, 2008 at 10:43 PM, Tony Paloma <[EMAIL PROTECTED]> wrote: > The attack stopped right about when I sent that email, so I can't try > changing those. The CVARs right now and during the attack were at the > default. I will probably lower sv_max_queries_sec_global. It lasted about > 5-10 minutes. It was happening on all three servers and continued even if I > restarted. If I changed the IP or port of the servers, everything was fine > which means the attacker was targeting those specific servers. > > I didn't get the chance to try getting IP addresses. > > > -----Original Message----- > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Andreas Grimm > Sent: Sunday, April 20, 2008 10:30 PM > To: 'Half-Life dedicated Win32 server mailing list' > > > Subject: Re: [hlds] New server attack/exploit? > > Perhaps these commands may help you to test, if it's a query spam: > > sv_max_queries_sec (default 3) > Maximum queries per second to respond to from a single IP address. > > sv_max_queries_sec_global (default 60) > Maximum queries per second to respond to from anywhere. > > Andreas > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Tony Paloma > Sent: Monday, April 21, 2008 7:12 AM > To: 'Half-Life dedicated Win32 server mailing list' > Subject: [hlds] New server attack/exploit? > > My TF2 server is currently under attack and is being brought to its knees. > The network graph shows lots of incoming data and the server is empty > running at 10.0fps. I think somebody is spamming queries or something, but > I'm not sure. Anybody know anything about this? > > Thanks, > Tony Paloma > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds > _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds
