Register FAQ Search Today's Posts Mark Forums Read
Go Back   JazzJackrabbit Community Forums » Open Forums » General Jazz Jackrabbit Talk

DoS attacks...

Lark

JCF Member

Joined: Jan 2002

Posts: 1,564

Lark has disabled reputation

Apr 14, 2004, 05:33 PM
Lark is offline
Reply With Quote
DoS attacks...

For two days in a row now my server has been being DoS attacked. Today, Nimrod's server, BlurredD's server, EvilMike's server, and some other server were all DoS attacked at the same time. I suggest everyone puts on ApprehendJJ2.exe while hosting, and if you find the DoS attacker's, IP, show Nimrod a log.
__________________
=D

Last edited by LAb RaT kiD; Apr 15, 2004 at 10:13 AM.
Link

Untitled

Joined: Apr 2001

Posts: 2,099

Link is doing well so far

Apr 14, 2004, 05:38 PM
Link is offline
Reply With Quote
If possible could people also send me the binary log file from ApprehendJJ2? (and tell me what IP the attack was from)

I know there are some things it doesn't detect properly (specifically server-crashing DoS attacks), and I want to fix that.
__________________
With our extreme gelatinous apology,
We beg to inform your Imperial Majesty,
Unto whom be dominion and power and glory,
There still remains that strange precipitate
Which has the quality to resist
Our oldest and most trusted catalyst.
It is a substance we cannot cremate
By temperatures known to our Laboratory.

~ E.J. Pratt
 
Violet CLM

JCF Éminence Grise

Joined: Mar 2001

Posts: 11,090

Violet CLM has disabled reputation

Apr 14, 2004, 06:05 PM
Violet CLM is offline
Reply With Quote
I don't know if it was a DoS attack, but someone with the IP of 66.90.77.18 crashed my server a few times recently. Just by joining - no name visible.
Blackraptor

JCF Member

Joined: Sep 2002

Posts: 3,702

Blackraptor is an asset to this forumBlackraptor is an asset to this forum

Apr 14, 2004, 06:08 PM
Blackraptor is offline
Reply With Quote
Yeah, I've witnessed it in mikes server, lrk's server and the like. A noname joins, then I got high amounts of baud received and everyone looked like they were timing (I assumed the server crashed, but I was in it for a few min after), I tried to say something but apparently the noname thing kept inserting blank lines of text (no colon) rapidly so my text kept dissapearing with the blink of an eye. Didn't personally crash my server, though, since I cant host =P
__________________
Fear cuts deeper than swords
Risp_old

JCF Member

Joined: Mar 2003

Posts: 3,992

Risp_old is doing well so far

Apr 14, 2004, 06:21 PM
Risp_old is offline
Reply With Quote
The best protection to keep your server from being crashed: not hosting.
__________________
<img src="http://i25.photobucket.com/albums/c100/Ashton_JX/the_web/stupid_prize.gif" border="0" alt="The rodent thingy wasn't worthy.">
I would not want anyone having sex with my cocktail. ~ Radium
Blackraptor

JCF Member

Joined: Sep 2002

Posts: 3,702

Blackraptor is an asset to this forumBlackraptor is an asset to this forum

Apr 14, 2004, 07:11 PM
Blackraptor is offline
Reply With Quote
Quote:
Originally Posted by RSPSS FR
The best protection to keep your server from being crashed: not hosting.
That's also a best way to help jj2 die out.
__________________
Fear cuts deeper than swords
R3ptile

Banned

Joined: Aug 2003

Posts: 3,885

R3ptile is doing well so far

Apr 15, 2004, 06:17 AM
R3ptile is offline
Reply With Quote
When AvK hosted my duels then some idiot joined as some kinda weird nickname and his IP wasn't available, when he tried to kick him, the server just crashed. I didn't see him. When this guy also joined my server, it happened again, but this time Newspaz saw him in the server. Well, he is kinda h4x0r or so, I have no idea who he can be, and I couldn't get his IP. Lately, it seems like he is gone, but he always comes back after short time. I hope Nimrod is going to do something with that, and ban the hackers (or so), at last! o.O

~R3ptile
Nimrod

JCF Member

Joined: Jul 2001

Posts: 827

Nimrod has disabled reputation

Apr 15, 2004, 10:06 AM
Nimrod is offline
Reply With Quote
Quote:
Originally Posted by R3ptile
I hope Nimrod is going to do something with that, and ban the hackers (or so), at last! o.O

~R3ptile
A) Its not my job, I have a lot more things to do in life, than spend my time taking notes of IP and taking action.

B) The moment I made a comment about installing some IP Filtering stuff on the List Servers, i had a loads of people screaming out saying that Im abusing my power.. Make up your fricken mind people.

C) Try asking more politely.


Also on the note of those players who join with 'Unknown Network Addresses', if you kick them your JJ2 will Crash. You can remove them using Controller 4, by Overlord.

I had quite a few of them in the After Party Server, all from the same IP. They oberviously thought I wasnt running anyform of packet Monitor and ended up getting caught. I am thinking about speaking to there ISP's Abuse department, providing logs and seeing what action they can take.

Feel free to look at the persons IP:
http://hosting.nimrod-online.com/Caught.JPG
__________________
-Nimrod
Old Apr 15, 2004, 10:07 AM
Nimrod
This message has been deleted by Nimrod.
Lark

JCF Member

Joined: Jan 2002

Posts: 1,564

Lark has disabled reputation

Apr 15, 2004, 10:15 AM
Lark is offline
Reply With Quote
I had the exact same problem as Violet. That is a DoS attack, Violet. The server crashes so quickly, ApprehendJJ2.exe and JJ2 don't have time to tell you an IP.
__________________
=D
Blackraptor

JCF Member

Joined: Sep 2002

Posts: 3,702

Blackraptor is an asset to this forumBlackraptor is an asset to this forum

Apr 15, 2004, 12:31 PM
Blackraptor is offline
Reply With Quote
Once some time ago I had 4 hacker bots in my server. If I'd have kicked/banned any of them my jj2 crashed, so I just left them there and they caused no harm whatsoever. But I doubt its one of these types of bots so..=\
__________________
Fear cuts deeper than swords
Nimrod

JCF Member

Joined: Jul 2001

Posts: 827

Nimrod has disabled reputation

Apr 16, 2004, 07:36 AM
Nimrod is offline
Reply With Quote
I have been collecting 'IPs' of these so call Fake players, They all come from the same Provider.

An ASDL/Dial Up Provider (as there IP changes slightly).

Im collecting as many logs as possible, and sending to the abuse department, If anyone else has any, please share and ill see what I can do.
__________________
-Nimrod
Link

Untitled

Joined: Apr 2001

Posts: 2,099

Link is doing well so far

Apr 16, 2004, 10:06 AM
Link is offline
Reply With Quote
I know that deliberately crashing servers is technically illegal and you have every right to report it to their ISP, but wouldn't it make more sense to talk to the person first and ask them to stop?
__________________
With our extreme gelatinous apology,
We beg to inform your Imperial Majesty,
Unto whom be dominion and power and glory,
There still remains that strange precipitate
Which has the quality to resist
Our oldest and most trusted catalyst.
It is a substance we cannot cremate
By temperatures known to our Laboratory.

~ E.J. Pratt
 
Nimrod

JCF Member

Joined: Jul 2001

Posts: 827

Nimrod has disabled reputation

Apr 16, 2004, 10:44 AM
Nimrod is offline
Reply With Quote
It would, but when they have a dynamic IP, it makes it a lot harder to track them down, it would be easier to speak to there ISP, as they would know who they are.
__________________
-Nimrod
Black Ninja

JCF Member

Joined: Mar 2001

Posts: 2,312

Black Ninja is an asset to this forumBlack Ninja is an asset to this forum

Apr 16, 2004, 04:17 PM
Black Ninja is offline
Reply With Quote
just today my server crashed, apparently by another DOS attack. However, I was unsuspecting and didn't get the IP.
Trafton

JCF Member

Joined: Oct 2002

Posts: 3,589

Trafton is an asset to this forum

Apr 16, 2004, 05:04 PM
Trafton is offline
Reply With Quote
Blah. There's really no need to get excited about this. I'm aware of who did the DoS'ing, and will contact them as soon as possible.

The crashing is another story, but if you get the IP of another crasher, feel free to PM me it and I will look into it. I can't promise I will get a result, but I oftentimes do.

For future reference, posting IP addresses in public under most circumstances is a very bad idea.

~ Traft
Lark

JCF Member

Joined: Jan 2002

Posts: 1,564

Lark has disabled reputation

Apr 16, 2004, 05:46 PM
Lark is offline
Reply With Quote
At times like this, I always have ApprehendJJ2.exe when I'm hosting, even if it doesn't matter if I crash or not that much. If I caught a DoS attacker, I'd have bragging rights. =P
__________________
=D
Nimrod

JCF Member

Joined: Jul 2001

Posts: 827

Nimrod has disabled reputation

Apr 16, 2004, 05:54 PM
Nimrod is offline
Reply With Quote
Quote:
Originally Posted by Trafton
Blah. There's really no need to get excited about this. I'm aware of who did the DoS'ing, and will contact them as soon as possible.
Beat you to it, and they claim there innocent
__________________
-Nimrod
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump

All times are GMT -8. The time now is 05:08 AM.