[nitz]

Hello guys,

I run a 24 hours/day server on a Windows Box, it's a Counter-Strike 1.6 server which works flawless until it crashes and I have few reasons to think there is someone using a kind of exploit to bring my server down.

These are the following metamod addons currently running:

[ 1] HLGuard RUN - hlguard_mm_optim v1.8 ini Chlvl Chlvl [ 2] AMX Mod X RUN - amxmodx_mm.dll v1.8.1.3 ini Start ANY [ 3] Booster RUN - booster_686_mm.d v2.40 ini Chlvl Pause [ 4] MySQL RUN - mysql_amxx.dll v1.8.1.3 pl3 ANY ANY [ 5] Fun RUN - fun_amxx.dll v1.8.1.3 pl3 ANY ANY [ 6] Engine RUN - engine_amxx.dll v1.8.1.3 pl3 ANY ANY [ 7] FakeMeta RUN - fakemeta_amxx.dl v1.8.1.3 pl3 ANY ANY [ 8] CStrike RUN - cstrike_amxx.dll v1.8.1.3 pl3 ANY ANY [ 9] CSX RUN - csx_amxx.dll v1.8.1.3 pl3 ANY ANY [10] Ham Sandwich RUN - hamsandwich_amxx v1.8.1.3 pl3 ANY

I have tried turning off one by one, including HLGuard and HLBooster then AMXX modules itself, however, I found out AMXX is the one causing the crashes. After I successfully disabled AMXX the server stopped crashing.

So, my first bet was some plugin being the cause of my headache, so I decided to try turning one by one off and seeing what happens. Actually, I did it in groups of 5 since my server has a lot of plugins. (The ones causing errors are always removed until they are fixed, I have no error log in my server folder.)

Nothing, after hours spent on it, the server would randomly crash so I tried a clean install of AMXX.

Nothing too!

Now, I noticed something rather curious this week when the console screen caught my attention while I was configuring some stuff on my other server. There was some guy chatting with the other one... I've translated it into English:

Player: lol it was easy huh Player 2: haha u pwned Player 2: do it again when the server gets full Player: wait until that noobass admin comes on Player: u know I can do it as many times as I want Player 2: yeah Player 2: we should announce our server in here Player 2: then we crash it, people move on Player: yea and ban is useless

So I banned both of them, curiously they had the same IP range, then I added the full XX.XXX.0.0.

They have been previously banned by cheating, and they have been crashing my server a lot, I do not know what to do. He has like 5 SteamIDs banned and now, seems like I got it right through his IP address but still, he keeps crashing my server. I disabled all the addons I had in it, this fixed the problem by leaving AMXX out, I do not know how he has been doing it!

My server without AMXX is crappy, by the way, by putting a server password he is not able to crash my server.

Any thoughts about what he could be using to bring my server down? The HLDS sends out a blank window with a blank button and stops responding.

Thanks very much guys, I'd appreciate any help, my Source server has no issues with it, and I've had few hints he had been there too.

[fysiks]

Have you changed your rcon password?

I would suggest that when you are debugging you should start with adding AMXX but only the default plugins. Then, if that's fine start enabling plugins one by one. I think this will be much better than having everything running and then disabling plugins.

[nitz]

Hello fysiks,

I do change the rcon password on regular basis with random words/numbers, no one knows it but myself, not even the admins of my server.

When I reinstalled AMXX, I only used it with the default plugins still it happened. I am currently adding several IP ranges to my router firewall trying to sort this issue out, but still having some issues. And from what I read on the chat posted previously I'm pretty sure it's this guy who is attacking me. My router has detected some DDoS attempts, as well as UDP Flood.

Thank you

[sweet]

Try using Anti CsDoS by shockingsoft.com

[nitz]

I thought csdos was for nosteam servers? If yes, it doesn't apply for my server.

[sweet]

It should block UDP floods, if I'm not wrong. But its worth atry.

[kobri]

Same stuff here, even though I'm using protection server still crashes...

There might be something to do with player auth, because I noticed one player reconnecting like 20-30 times in a row.