AlliedModders

AlliedModders (https://forums.alliedmods.net/index.php)
-   Source Servers (SRCDS) (https://forums.alliedmods.net/forumdisplay.php?f=130)
-   -   Query flood (https://forums.alliedmods.net/showthread.php?t=305800)

nixonkat 03-04-2018 12:15

Query flood
 
Hi!
On the forums (I took this from a older thread) I saw things regarding:
IP rate limit sustained 2571306 distributed packets at 85710.2 pps (14999 buckets).
IP rate limit under distributed packet load (6785 buckets, 9001 global count), rejecting 69.15.142.250:10250.
IP rate limit sustained 2037121 distributed packets at 67904.0 pps (6056 buckets).
IP rate limit under distributed packet load (6679 buckets, 9001 global count), rejecting 4.202.201.60:31288.
IP rate limit sustained 1667233 distributed packets at 55574.4 pps (6212 buckets).

Anyone saying "Any good host can protect against this"

Kind of... So ArborNetworks can't do much unless you order extended licenses. Great.
If you then were that guy who bought their extended license (which has a high cost to it) you'll find out it will filter real traffic aswell. So you'll have quite some false positives

How does it work with guys like OVH? They use pre-caching i know, but how?

Analyzing this in a pcap file (Which I can add here on request), it's not much bandwidth used, but alot of packets.

I was peaking at 500k packets per second.

Is there no way to fix this? Of course blocking the port works great. But then services will also be blocked.

I know how ddos works, and how protection works so please dont "You have no idea". However, there must be some rules etc to fix this. Many servers in the world has fixed it.

I read something about pre-caching which I found interesting, but I could't quite figure it out.

Please, if anyone knows anything, let me know!

asdfxD 03-04-2018 12:34

Re: Query flood
 
cache: https://forums.alliedmods.net/showpo...6&postcount=32
ddos protection/kernel redirection: https://forums.alliedmods.net/showthread.php?t=297237

if u have linux.

nixonkat 03-04-2018 12:53

Re: Query flood
 
Hi.
I do, however, even with my Linux knowledge im on deep water with those..

Fluxxx 03-04-2018 14:44

Re: Query flood
 
Quote:

Originally Posted by asdfxD (Post 2581334)

That cache plugin does not work on linux ubuntu 16.04

asdfxD 03-04-2018 22:56

Re: Query flood
 
Quote:

Originally Posted by Fluxxx (Post 2581353)
That cache plugin does not work on linux ubuntu 16.04

nah, it works.

https://i.imgur.com/QIOvBWi.png

i use custom kernel and xanmod kernel on other server, so try xanmod kernel.

LaRoVV66 03-05-2018 15:12

Re: Query flood
 
hi;

say me private i install your server firewall.

nixonkat 03-06-2018 02:58

Re: Query flood
 
Hi everyone!

The cache plugin etc, does it really fix "DDos"?

Like how c an it block the traffic? Is it set to block anything that isn't cached? Like I am unsure how it works. And if it really helps me

nixonkat 03-06-2018 03:13

Re: Query flood
 
Also
[SM] Extension qcache_mm.so.ext.dll failed to load: error code 0000007e
L 03/06/2018 - 09:12:44: rcon from "103.57.75.17:52310": command "sm exts load qcache_mm.so"

Squallkins 03-06-2018 14:04

Re: Query flood
 
eh?

Quote:

Originally Posted by nixonkat (Post 2581582)
Also
[SM] Extension qcache_mm.so.ext.dll failed to load: error code 0000007e
L 03/06/2018 - 09:12:44: rcon from "103.57.75.17:52310": command "sm exts load qcache_mm.so"


nixonkat 09-15-2018 07:10

Re: Query flood
 
Hi!
This is still an ongoing issue:

I used this:
https://www.mail-archive.com/search?...2&o=newest&f=1

And it also works, I see this:
http://prntscr.com/kuopfw

However, I cannot join the server on port 29015... How come?


All times are GMT -4. The time now is 04:37.

Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.