you guys may want to ban the following steamid: STEAM_0:1:5291510 this guy was on my CS:S server, was banned for TK'ing player (by a script), and proceeded to launch a simple DOS attack which managed to crash the CS:S server. he continued his attack (looked like connect attempts in the log) for several minutes, bringing the server down 3 times until a firewall rule kicked in and blocked his ip at that level.
unfortunately the ip came from a comcast address: 24.4.140.131 so it'll prolly change in a few days or, if he's got any ganglia in his brain, perhaps he'll think of rebooting his modem... anyway, I emailed the abuse dept at comcast about the incident and included the logs so hopefully they'll be able to trace who owned the ip at the time and [hopefully] take some sort of action. would be nice if VAC would detect these kinds of attacks and permanently ban the users across the entire network. as it is, y'all just have to take my word for it. here's a tail bit from the logs just before the server crashed the first time (note how strange the log is, he was connecting multiple times somehow): L 02/02/2005 - 18:32:36: "Govna<19510><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:37: "Hermy the Steamy Pile<19467><STEAM_0:1:346811><CT>" say "teach me how to use that gun" L 02/02/2005 - 18:32:37: "peter bogdonavich<19473><STEAM_0:1:5244098><TERRORIST>" say "damn" L 02/02/2005 - 18:32:37: "Govna<19510><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:38: "Govna<19511><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:39: "Govna<19511><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:40: "Govna<19512><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:40: "Govna<19512><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:41: "Govna<19513><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:41: "Hermy the Steamy Pile<19467><STEAM_0:1:346811><CT>" say "youre so good" L 02/02/2005 - 18:32:41: World triggered "Round_Start" L 02/02/2005 - 18:32:42: "Govna<19513><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:43: "Govna<19514><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:43: "Govna<19514><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:44: "Govna<19515><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:45: "Govna<19515><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2005 - 18:32:45: "Slim the Slimest Slimjim<19477><STEAM_0:1:4424317><TERRORIST>" say_team "i k" L 02/02/2005 - 18:32:46: "Govna<19517><STEAM_ID_PENDING><>" connected, address "24.4.140.131:27005" L 02/02/2005 - 18:32:47: "Govna<19517><STEAM_0:1:5291510><>" disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") L 02/02/2 ^^^^ this is where the server segfaulted I don't see a core dump anywhere ~j _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
