Update on Rcon Dos Attacks?

medic917 · **Author**

So I got a dos attack today with this error spamming right before server crashed.
Socket ProcessAccept Error: Too many open files
Socket ProcessAccept Error: Too many open files
Socket ProcessAccept Error: Too many open files

I read about it and is iptables method the only way to fix it? Or is smac's rcon plugin enough?
I also read this exploit was fixed by valve a long time ago but I guess there is still ways around it?

It's a shame people have to attack others, I don't know why they do this...

pcmaster · 12-14-2015 , 13:40 Re: Update on Rcon Dos Attacks?

The simplest way is to simply block all TCP traffic to that port except from your own IP, that's at least how I do it.

Darkness_ · *Last edited by Darkness_; 12-14-2015 at 16:13.*

I had this same issue a while back - it turned out a plugin was doing too many file operations ( open, write, close, repeat ) in a short time span rapidly. Upon deleting the culprit plugin this error completely ceased. If I was you I would analyze the plugins you are running that use File I/O before moving onto trying some IP tables methods and or blocking the TCP port as pcmaster suggested.

Good luck.

medic917 · *Last edited by medic917; 12-16-2015 at 22:49.*

darkness any way to investigate and help me find which plugin is causing it?
Or do I have to use trial and error?

----edit----
looks like it was a dos after all, only my most popular servers are getting this issue.
I just used a firewall and hopefully it does the trick.

Dr. Greg House · 12-16-2015 , 23:46 Re: Update on Rcon Dos Attacks?

Looks more like syn-flood.
Using non-default ports for everything and properly configuring iptables helps. And just whitelist ips for rcon or block it entirely.