About MadPacketFilterV2

[sskzww]

Someone hacked my server with wpe,he send packet to my server ,so i use MadPacketFilterV2 fo filter that.but there is a problem.
i find they send packet like this:
1c 22 00 56 0b 08 00 00 00 01
1b 22 00 56 0b 08 00 00 00 01
1f 22 00 56 0b 08 00 00 00 01
so i set this in PacketFilterConfig.ini

[PACKET_CONTENT_FILTER]
0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01

but the packet not be filter :

someone tell me why?

 

[sadi]

1c 22 00 56 0b 08 00 00 00 01=0x1c 0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01

 

[Ron]

Read above. Your packet filter format is incorrect.

 

[sskzww]

1c 22 00 56 0b 08 00 00 00 01=0x1c 0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01

I kown that,but I want this:
"they send packet like this:
1c 22 00 56 0b 08 00 00 00 01
1b 22 00 56 0b 08 00 00 00 01
1f 22 00 56 0b 08 00 00 00 01
.... and so on.
i mean they send the packet "* 22 20 26 0b 08 00 00 00 01",and I want filter all packet include "22 00 56 0b 08 00 00 00 01",so I set this:
[PACKET_CONTENT_FILTER]
0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01
Am I wrong?

 

[Ron]

Looks correct to me. Can you show a screenshot of the full filter settings?

 

[sskzww]

Looks correct to me. Can you show a screenshot of the full filter settings?

Here it is:

[SERVER]SERVER_BIND_IP=192.168.1.228SERVER_BIND_PORT=29228[REDIRECT]REDIRECT_IP=127.0.0.1REDIRECT_PORT=27780#define SILENT_MODE 0#define PRINT_MODE 1#define FILE_MODE 2[MODE]MODE=2[BUFFER]LOG_MEMORY_BUFFER=50[PACKET_CONTENT_FILTER]0xBB 0x29 0x61 0x21 0x7C 0xAF 0x65 0x05 0xDE 0xB3 0xF0 0xE9 0x86 0xBA 0x7C 0x91 0x6F 0x84 0x80 0xF1 0xC9[PACKET_CONTENT_FILTER]0x1C 0x00 0x16 0x38 0x04 0x05 0x34 0x6C 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00[PACKET_CONTENT_FILTER]0x13 0x00 0x11 0x04 0x3d 0x00[PACKET_CONTENT_FILTER]0x13 0x11 0x04 0x00 0x11[PACKET_CONTENT_FILTER]0xFB 0x00 0x3A 0x01[PACKET_CONTENT_FILTER]0x08 0x00 0x0E 0x01 0xD2 0x11 0x32 0x00[PACKET_CONTENT_FILTER]0x0A 0x00 0x3 0x2B 0x04 0x07 0xE3[PACKET_CONTENT_FILTER]0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01

 

[Ron]

Here it is:

[SERVER]SERVER_BIND_IP=192.168.1.228SERVER_BIND_PORT=29228[REDIRECT]REDIRECT_IP=127.0.0.1REDIRECT_PORT=27780#define SILENT_MODE 0#define PRINT_MODE 1#define FILE_MODE 2[MODE]MODE=2[BUFFER]LOG_MEMORY_BUFFER=50[PACKET_CONTENT_FILTER]0xBB 0x29 0x61 0x21 0x7C 0xAF 0x65 0x05 0xDE 0xB3 0xF0 0xE9 0x86 0xBA 0x7C 0x91 0x6F 0x84 0x80 0xF1 0xC9[PACKET_CONTENT_FILTER]0x1C 0x00 0x16 0x38 0x04 0x05 0x34 0x6C 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00[PACKET_CONTENT_FILTER]0x13 0x00 0x11 0x04 0x3d 0x00[PACKET_CONTENT_FILTER]0x13 0x11 0x04 0x00 0x11[PACKET_CONTENT_FILTER]0xFB 0x00 0x3A 0x01[PACKET_CONTENT_FILTER]0x08 0x00 0x0E 0x01 0xD2 0x11 0x32 0x00[PACKET_CONTENT_FILTER]0x0A 0x00 0x3 0x2B 0x04 0x07 0xE3[PACKET_CONTENT_FILTER]0x22 0x00 0x56 0x0b 0x08 0x00 0x00 0x00 0x01

That looks correct. You're sure its not filtering the packet? Have you used wireshark as a test?

 

[sskzww]

That looks correct. You're sure its not filtering the packet? Have you used wireshark as a test?

Sure.And I have test several times.I have no idea now. Help me plz.

 

[Ron]

Sure.And I have test several times.I have no idea now. Help me plz.

Sorry dude. Maybe someone else can chime in as I'm not seeing the issue with the filter providing you're testing the right packets.