04/04/2015 - Server Crashes Resolved

[Fredy]

04/04/2015 - Server Crashes Resolved

As all of you have noticed already the server kept crashing for the past few days and some guy has claimed to be the one causing them. I have found out how he was doing it and completely blocked all attacks like this from happening again.

For anyone who wants to know a bit more:

Spoiler: Info

The DoS attack that was used to crash the server was most likely something called a TCP SYN flood attack (You can read up on it here). As soon as someone tries to connect to a server through TCP (rcon as an example) the server sends a response to the client which the client has to respond to for the connection to open successfully (that way people can't fake their IP). The problem here is that the server pretty much stores the request for some time to wait for the client's response. A TCP SYN flood just spams tons of these requests without ever responding to the server. Unfortunately there is a limit for these stored requests so as soon as it reaches the limit the server crashes (probably because of bad coding on Valve's side). To fix it I just blocked all TCP connections to the server (no rcon anymore ) through the firewall

ADHD version: Server won't crash all the time anymore.​

 

[Angelos]

Finally

 

[netroak]

thanks for the ADHD version

 

[Creepis]

Best ADHD version.

Bus wurde gebaut, danke, Fredy.

 

[netroak]

Bus bauen fredy

http://puu.sh/h1Dtx/99ec9377f0.png

 

[Trande]

Tell us who did it

 

[Bamarin [IT]]

i can't believe it... we were studying TCP based attacks just before the easter break, SYN-Flooding in particular, i know it solved now, but the best way isn't blocking the request, it's better using a SYN-cookies system: so you don't have to store the Sequence Number as the cookies will automatically calculate it

 

[Therealshift]

This is good news to hear! Thanks for working hard to resolve the issue

 

[Riekelt]

What a SYN Flood is explained to a 5 year old:
Lets take Chris and AyJay as an example.
AyJay walks up to Chris and says "Hi", to which Chris responds with "Hey".
AyJay can either say "What's Up" or just walk away, but he just stands there staring at Chris.
Chris is left confused and has no idea what the fuck he should do.
Now if Creepis was to walk up, and take a army of Sweatervests with him and do the same thing over and over again eventually Chris will panic and die. In our case Chris is the server, and AyJay, Creepis and the Sweatervests are the flooders.

 

[Daniel Mitchell]

YESSS

 

[Bradley]

Smashing!
Good Job.

 

[MrAaron]

Thanks dad.

 

[Eyecon]

I actually have this script if you would like to look over it....for future protection.