Project Perfect Mod Forums
:: Home :: Get Hosted :: PPM FAQ :: Forum FAQ :: Privacy Policy :: Search :: Memberlist :: Usergroups :: Register :: Profile :: Log in to check your private messages :: Log in ::


The time now is Thu Mar 28, 2024 5:55 pm
All times are UTC + 0
cncnet under attack
Moderators: Global Moderators
Post new topic   Reply to topic Page 1 of 1 [10 Posts] Mark the topic unread ::  View previous topic :: View next topic
Author Message
Lin Kuei Ominae
Seth


Joined: 16 Aug 2006
Location: Germany

PostPosted: Fri Feb 28, 2014 9:15 pm    Post subject:  cncnet under attack Reply with quote  Mark this post and the followings unread

While waiting for someone to join my hosted DTA game, a guy called Smith joined.
A few seconds later dozens of auto-generated players joined and bombed the hosted game.

Using the log file i confirmed that all these came from the same IP address
187.56.89.17

The only way for me to stop this was killing the DTAlauncher task.

I tried it once again a few minutes later. Same attack.

Once again 10 minutes later, the DTA launcher and the cncnet5.exe both say, "connection limit reached" and the cncnet.org chat isn't available anymore.


I'm not sure if this happened in the past already but i think this is the first DOS attack on cncnet. Though a rather stupid one, as the IP address doesn't looks like a proxy, but the real one.
\Edit
oh, looks like this attack is done from a public internet cafe or restaurant from Sorocaba near Sao Paulo.

_________________
SHP Artist of Twisted Insurrection:  Nod buildings

Public SHPs
X-Mech Calendar (28 Mechs for GDI and Nod)
5 GDI, 5 Nod, 1 Mutant, 1 Scrin unit, 1 GDI building

Tools
Image Shaper______TMP Shop______C&C Executable Modifier

Back to top
View user's profile Send private message
Crimsonum
Seth


Joined: 14 Jul 2005
Location: Fineland

PostPosted: Fri Feb 28, 2014 9:32 pm    Post subject: Reply with quote  Mark this post and the followings unread

Is there an option to ban said IP from cncnet yet?

_________________


Back to top
View user's profile Send private message
Nikademis Von Hisson
General


Joined: 05 Sep 2007
Location: Wilkes Barre PA

PostPosted: Fri Feb 28, 2014 9:48 pm    Post subject: Reply with quote  Mark this post and the followings unread

is it possible to check the hardware id? ban an IP is fine, but I can turn my router off and get a new IP.

_________________
I am authorized to send out the TMP Studio, PM ME IF YOU WANT IT And check this out, these were sent to me for help with terrain and zdata help along with TMP Studio/Builder

http://www.ppmsite.com/forum/viewtopic.php?t=27714

Back to top
View user's profile Send private message Send e-mail Skype Account
RP
Commander


Joined: 12 Jul 2012
Location: Mapping God Heaven

PostPosted: Fri Feb 28, 2014 10:12 pm    Post subject: Reply with quote  Mark this post and the followings unread

So that's why the matches didn't go well at all...
Goddamn children, CnCNet should really make a system that auto-bans people in case of a flood/DDOS...

_________________


Mental Omega 3.0 Mission creator - Creator of FinalOmega: APYR 3.0 Map Editor

/ppm/'s stupidity

Back to top
View user's profile Send private message
Lin Kuei Ominae
Seth


Joined: 16 Aug 2006
Location: Germany

PostPosted: Fri Feb 28, 2014 10:40 pm    Post subject: Reply with quote  Mark this post and the followings unread

Since this guy wasn't listed in the Lobby, he might also somehow passed by cncnet and attacked me directly.
It isn't hard to check cncnet for the hosted games, get the IP address of the hosting person and then attack the hoster directly.

Right now it also seems to work fine again as i can log in again.

_________________
SHP Artist of Twisted Insurrection:  Nod buildings

Public SHPs
X-Mech Calendar (28 Mechs for GDI and Nod)
5 GDI, 5 Nod, 1 Mutant, 1 Scrin unit, 1 GDI building

Tools
Image Shaper______TMP Shop______C&C Executable Modifier

Back to top
View user's profile Send private message
^Rampastein
Rampastring


Joined: 11 Oct 2008
Location: Gensokyo

PostPosted: Sat Mar 01, 2014 1:31 am    Post subject: Reply with quote  Mark this post and the followings unread

The Launcher only receives traffic from the CnCNet IRC server, so he couldn't have attacked you directly. I'll look into preventing some of such attacks in upcoming versions of the Launcher, although being a client the options are a bit limited.

_________________
CnCNet Client | CnCNet TS patches | More Quality-of-Life Improvements for RA Remastered


Back to top
View user's profile Send private message ModDB Profile ID Facebook Profile URL
Banshee
Supreme Banshee


Also Known As: banshee_revora (Steam)
Joined: 15 Aug 2002
Location: Brazil

PostPosted: Sat Mar 01, 2014 4:13 am    Post subject: Reply with quote  Mark this post and the followings unread

http://cqcounter.com/whois/?query=187.56.89.17&map=1#map_geo_location

According to that page, it comes from a residential building in Campinas, SP, Brazil. The service provider is the Vivo, the most popular one in the state of São Paulo (Vivo belongs to Telefonica). I don't think this IP is static, due to the nature of the ISP.

This IP was never used in Revora and I don't have tools to find its usage in PPM. I've looked into posts from DTA forums and IPs from guests, but I couldn't find anything there.

Back to top
View user's profile Send private message Visit poster's website Skype Account
hifi
Vehicle Driver


Joined: 23 Nov 2011
Location: Basement

PostPosted: Sun Mar 09, 2014 6:52 am    Post subject: Reply with quote  Mark this post and the followings unread

Connections from single ip address have been limited to 6. No one should be able to do this kind of "attack" without creating a small botnet first.

Back to top
View user's profile Send private message
Matthias M.
Stealth Laser Trooper


Joined: 15 Jun 2012
Location: Germany

PostPosted: Sun Mar 09, 2014 2:37 pm    Post subject: Reply with quote  Mark this post and the followings unread

Maybe a (bad) developer pinging you to death accidentally?

Back to top
View user's profile Send private message
Dutchygamer
President


Joined: 18 Jun 2005
Location: Dordrecht, the Netherlands

PostPosted: Sun Mar 09, 2014 5:07 pm    Post subject: Reply with quote  Mark this post and the followings unread


Back to top
View user's profile Send private message Send e-mail Skype Account
Display posts from previous:   
Post new topic   Reply to topic Page 1 of 1 [10 Posts] Mark the topic unread ::  View previous topic :: View next topic
 
Share on TwitterShare on FacebookShare on Google+Share on DiggShare on RedditShare on PInterestShare on Del.icio.usShare on Stumble Upon
Quick Reply
Username:


If you are visually impaired or cannot otherwise answer the challenges below please contact the Administrator for help.


Write only two of the following words separated by a sharp: Brotherhood, unity, peace! 

 
You cannot post new topics in this forum
You can reply to topics in this forum
You can edit your posts in this forum
You can delete your posts in this forum
You can vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © phpBB Group

[ Time: 0.1525s ][ Queries: 11 (0.0090s) ][ Debug on ]