My server segfaults nearly every day (srcds_i486, 2.4.28-gentoo-r5 SMP kernel, glibc-2.3.4.20040808-r1). I don't see these connection attempt spams though..
It's becoming really frustrating. The pub is 32 players and pretty popular. It really ruins the experience when it crashes 2-3 times a night. I've heard reports of this exploit, but have never seen it happen around a join DoS. I have over 400 people in my ban file, too, and I've seen some of them try to rejoin immediately, but no server crash happened.. Anyone else get random crashes with srcds_i486? Or, even better, does anyone run this without any problems who could say what kernel and libc they are using? Original message from jules (aka Buddha-Pest): > you guys may want to ban the following steamid: STEAM_0:1:5291510 > > this guy was on my CS:S server, was banned for TK'ing player (by a > script), and proceeded to launch a simple DOS attack which managed to > crash the CS:S server. he continued his attack (looked like connect > attempts in the log) for several minutes, bringing the server down 3 > times until a firewall rule kicked in and blocked his ip at that level. > > unfortunately the ip came from a comcast address: 24.4.140.131 so it'll > prolly change in a few days or, if he's got any ganglia in his brain, > perhaps he'll think of rebooting his modem... > > anyway, I emailed the abuse dept at comcast about the incident and > included the logs so hopefully they'll be able to trace who owned the ip > at the time and [hopefully] take some sort of action. > > would be nice if VAC would detect these kinds of attacks and permanently > ban the users across the entire network. as it is, y'all just have to > take my word for it. > > here's a tail bit from the logs just before the server crashed the first > time (note how strange the log is, he was connecting multiple times > somehow): > > L 02/02/2005 - 18:32:36: "Govna<19510><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:37: "Hermy the Steamy > Pile<19467><STEAM_0:1:346811><CT>" say "teach me how to use that gun" > L 02/02/2005 - 18:32:37: "peter > bogdonavich<19473><STEAM_0:1:5244098><TERRORIST>" say "damn" > L 02/02/2005 - 18:32:37: "Govna<19510><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:38: "Govna<19511><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:39: "Govna<19511><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:40: "Govna<19512><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:40: "Govna<19512><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:41: "Govna<19513><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:41: "Hermy the Steamy > Pile<19467><STEAM_0:1:346811><CT>" say "youre so good" > L 02/02/2005 - 18:32:41: World triggered "Round_Start" > L 02/02/2005 - 18:32:42: "Govna<19513><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:43: "Govna<19514><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:43: "Govna<19514><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:44: "Govna<19515><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:45: "Govna<19515><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2005 - 18:32:45: "Slim the Slimest > Slimjim<19477><STEAM_0:1:4424317><TERRORIST>" say_team "i k" > L 02/02/2005 - 18:32:46: "Govna<19517><STEAM_ID_PENDING><>" connected, > address "24.4.140.131:27005" > L 02/02/2005 - 18:32:47: "Govna<19517><STEAM_0:1:5291510><>" > disconnected (reason "STEAM UserID STEAM_0:1:5291510 is banned") > L 02/02/2 > > > ^^^^ this is where the server segfaulted > > I don't see a core dump anywhere > > ~j > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, please > visit: > http://list.valvesoftware.com/mailman/listinfo/hlds_linux -- Chris _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
