Guys, Have you heard about the sourcebanner?

Moshiko014 · **Author**

Its look like this.
there's any way to block it?

AeroAcrobat · *Last edited by AeroAcrobat; 10-15-2014 at 14:00.*

whats the point of this?
I click on it and i get banned from some server?

Moshiko014 · 10-15-2014 , 14:38 Re: Guys, Have you heard about the sourcebanner?

Quote:

Originally Posted by AeroAcrobat

whats the point of this?
I click on it and i get banned from some server?

Yea.

Amroth · 10-15-2014 , 14:43 Re: Guys, Have you heard about the sourcebanner?

wut?

AeroAcrobat · *Last edited by AeroAcrobat; 10-15-2014 at 14:59.*

http://facepunch.com/showthread.php?t=1415383
http://www.reddit.com/r/GlobalOffens...u_from/cjjv5y6

I only see it as a problem if you have rcon ban time set really high.

Powerlord · *Last edited by Powerlord; 10-15-2014 at 15:59.*

So, basically it just uses Websockets to try to connect on the rcon port (which is the server port but over TCP)?

(Edit: Right, I should probably mention the two links @AeroAcrobat posted are blocked by my employer's web filter.)

Mitchell · 10-15-2014 , 17:00 Re: Guys, Have you heard about the sourcebanner?

if you're really concerned on blocking it I would just do a "sv_rcon_banpenalty" and set it to like 1. That way when they overflow the rcon the ban will only be for 1 minute.
I think other solutions were to disable rcon (you really don't need it anyways). I think the way to do that would be having a blank rcon password. (rcon_password "")
I may be wrong on how to disable it.

nikooo777 · 10-15-2014 , 17:34 Re: Guys, Have you heard about the sourcebanner?

they are spoofing the source IP to get you banned I guess.
Just drop TCP for port 27015 and you won't have problems anymore.
They'll give up.

ocwoody · 10-15-2014 , 17:48 Re: Guys, Have you heard about the sourcebanner?

Quote:

Originally Posted by nikooo777

they are spoofing the source IP to get you banned I guess.
Just drop TCP for port 27015 and you won't have problems anymore.
They'll give up.

This ^^

I've been doing this for years. Works wonders to protect RCON.

henk717 · *Last edited by henk717; 10-19-2014 at 15:33.*

I just patched my server against this.
Not only can rogue players do this, rogue servers could also do it with the motd with a script crawling ip's from the masterlist its very exploitative.

Luckily the real working patch is as simple as adding sv_rcon_maxpacketbans 0 to your console.
The browser exceeds the max packet number because there are multiple iframes going at once.