Solution against Crash

[PX2000]

you used "bm", right ?

yes...

 

[PwrDex]

iptables -A INPUT -m string --algo bm --string E2B70E -j DROP

can't test it because a module not found xpppp

 

[estsoft]

You don't need to search for the size. Also, take into account the size of the tcp header.

 

[PX2000]

iptables -A INPUT -m string --algo bm --string E2B70E -j DROP

can't test it because a module not found xpppp

If you are testing the crash tool that wont save you...

 

[xDarkMoon]

I guess it's time for me to give out my contribution here.
Has anyone ever thought about detecting the packet and blocking the IP? It's a temporary fix, but if you improve it you can make it permenant to block the packet it's self. I've seen some people autorestart/reload their loginSvr against the Version/MagicKey change packet, which felt a little dull to me because the attacker was sending packets every few seconds. However blocking the IP and looping would have made a difference for them.

And since it looks like you guys have figured some patterns as I can see, why not try doing something about it in C#? It doesn't have to be a complete proxy, rather it could be a start to a new one.

C# will make your lives easier on this one~ Just a friendly tip

PS: The simplest ways to do something are usually the ones you look into last.

 

[estsoft]

Vala would be far better to use than C#, as it compiles to native code so can be run directly on the server. You can do everything you need with iptables, though.

 

[xDarkMoon]

Vala would be far better to use than C#, as it compiles to native code so can be run directly on the server. You can do everything you need with iptables, though.

I've never used Vala, but I've heard about it. Although, as long as it's a language that can do what we need, I guess everyone's gonna be happy

 

[estsoft]

I've never used Vala, but I've heard about it. Although, as long as it's a language that can do what we need, I guess everyone's gonna be happy

You must be registered to see links

You must be registered to see links

<-- Windows builds

I use Vala all the time, now. I actually started converting Minerva to Vala a while back and noticed vast improvements.

 

[cadena]

so, the rule is iptables -A INPUT -m string --algo bm --string E2B7 -j DROP

 

[Elodie]

hello , just report this
iptables -A INPUT -m string --algo bm --string E2B70E -j DROP
iptables -A INPUT -m string --algo bm --string E2B7 -j DROP


doesn't work.

 

[Spik3man]

It dose work perfectly. !

 

[x30unlimited]

here does not work, what you did spike?

he used hex, and he lied about the "perfectly" part that's not the way to do it IF you give a fk about ur players and random d/c

 

[PunkS7yle]

he used hex, and he lied about the "perfectly" part that's not the way to do it IF you give a fk about ur players and random d/c

Why am I not surprised that spike is a jerk ?

 

[Komachi]

hello , just report this
iptables -A INPUT -m string --algo bm --string E2B70E -j DROP
iptables -A INPUT -m string --algo bm --string E2B7 -j DROP


doesn't work.

Nice work perfectly!
Very Thank you

 

[PX2000]

0000e2b7 for better accuracy

 

[jaguar666]

0000e2b7 for better accuracy

Tested perfectly. If you will use e2b7 only that will cause random DC especially during NW.

 

[aeyemo]

my idea
iptables -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH,ACK -m length --length 52 -m state --state ESTABLISHED -j DROP

 

[y0cata]

Tested perfectly. If you will use e2b7 only that will cause random DC especially during NW.

you don't need to block e2b7 in channels they are already forced to receive only encrypted packets.

 

[xDarkMoon]

Still need a solution ..
I can pay for it ..

The solution has already been posted. If you can't even understand English and actually willing to pay for someone to simply write lines/do research for you then I recommend you simply shut your server down.

 

[Spik3man]

Belive me. No one will ever sell to YOU something.And you know very well the reason SELFISH guy.