Help - Search - Members - Calendar
Full Version: JK2 Server - Lots of Packet Requests - DDOS?
The Planet Forums > System Administration > Game Hosting
astroboy5714
Hi, I am running a JK2 1.02 server, and am getting a ton of packet requests through the console:

SV packet 64.81.178.54:27243 : getstatus
SV packet 67.165.136.82:1119 : getstatus
SV packet 83.30.27.228:1189 : getstatus
SV packet 83.30.27.228:1189 : getstatus
SV packet 83.30.27.228:1189 : getstatus
SV packet 80.186.45.219:28070 : getinfo
SV packet 67.165.136.82:1120 : getstatus
SV packet 80.228.2.63:28070 : getinfo
SV packet 67.165.136.82:1121 : getstatus
SV packet 80.33.0.5:18797 : getinfo
SV packet 217.95.46.240:-563 : getinfo
SV packet 67.165.136.82:1122 : getstatus
SV packet 80.228.2.63:28070 : getstatus
SV packet 67.165.136.82:1123 : getstatus
SV packet 213.209.67.113:28070 : getinfo
SV packet 67.165.136.82:1124 : getstatus
SV packet 213.223.26.86:28070 : getinfo
SV packet 80.228.2.63:28070 : getinfo
SV packet 67.165.136.82:1125 : getstatus
SV packet 67.165.136.82:1126 : getstatus
SV packet 195.204.213.37:28071 : getinfo
SV packet 213.202.254.50:-15654 : getstatus
SV packet 80.228.2.63:28070 : getstatus
SV packet 213.209.67.113:28070 : getinfo

It doesn't matter whether I have RRAS enabled or disabled, I get these things anyway. I run other JK2 servers, and this does not happen... my customer says the server does not run well.

I also search Google for some of these IP's and it seems they are proxy servers, which is why I am thinking DDoS, however minimal it may be.


Any ideas on how to stop it?
CEREAL_KILLER
i think this is ASE users checking the status of your server. i used to see this alot on Mohaa. it may also be something such as HLSW.
talkster5
QUOTE (CEREAL_KILLER)
i think this is ASE users checking the status of your server. i used to see this alot on Mohaa. it may also be something such as HLSW.


With mohaa and cod i have seen this a few times and it may well be HLSW as i can only remember seeing it when i used it to monitor my servers but now i just use ASE and dont see it anymore.
klaude
That merely looks like clients getting system info. If you think you're under a DoS attack check your network utilization in Orbit. A maxed out network port can be caused by a DoS.

A little off topic, but props to running a 1.02 server. It's nice to see that community still alive. icon_smile.gif
astroboy5714
The fact that these IP's are widely used is strange though, isn't it? I mean if I search for them on Google it seems that they are obvious proxy servers that must be circulating for people to do things they shouldn't...

Also, I have run a few JK1.02 servers and this never happened. I tried switching IP's, switching systems even (with the same installation), and it did it right away, as soon as I started it.

I'm going to try copying an installation that doesn't do it from one of my servers to one of my Planet servers to see what happens... thanks for your replies! icon_smile.gif
Vox-uLaw
Kinda off topic, but why 1.02?
The backstabs?
klaude
Aside from filling up your logs is this causing any gameplay problems? It just looks like a series of ppl looking for server info.

Vox-utLaw: There's a 1.02 community still. The 1.03 patch was.. interesting. icon_smile.gif
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2010 Invision Power Services, Inc.