In case you have not noticed, our server and many others may not be showing up in various game monitoring programs and web sites.
It also may show up but show no players there when there really are some there.
Mike discovered that the gamespy port was being used in a Denial of Service attack.
He blocked the offending IP's, but a few days later it happened again and he had to block additional IP's'
If you see these symptoms, please inform an admin so we can investigate/contact Mike.
This is Mike's explanation:
--------------------------------------------------------------------------------------------------------------------------------
For those that might be interested, this is what was going on with our server/bfrm/gamespy the last few days.
A DRDoS ("Distributed Reflected Denial of Service") attack is a special type of DDoS . In a DRDoS, the target is not attacked directly; instead, the attacker sends faked (spoofed) traffic to a set of other IPs, which then respond to that traffic to the IP that was spoofed, and in doing so flood the victim offline. By sending packets that elicit a much larger response, the DRDoS initiator can generate a very large attack with a very small amount of traffic.
This type of attack has become very common lately. Here's a more specific example:
1. The attacker decides to target IP address 127.0.0.1:27015, which is a CS:S server that he has been banned from.
2. The attacker connects to a machine that he had previously compromised and uses a traffic generator tool to send simple query packets to a large number of other game servers, specifying a (fake) source of 127.0.0.1:27015. Each query packet is less than 50 bytes, so the attacker can send many thousands of these per second without using much bandwidth; even a very low-end machine can do it.
3. These game servers ("reflectors") respond to 127.0.0.1:27015 with much larger packets, often 500+ bytes long, containing lists of the players in those servers.
4. The CS:S server at 127.0.0.1:27015, upon receiving the huge wave of attack traffic from thousands of different IPs, is overwhelmed. It is unable to serve legitimate clients or respond to queries itself, causing a denial of service.
Many ISPs have "reverse path filtering" in place, which (for the most part) prevents customers from pretending to be IPs that they are not, also preventing them from being used to launch attacks like this. Unfortunately, not every provider can or does.
Our server was just an unknowing participant of someone else's war.
