[0.13.11] Mass Connection Requests

[Xelephant]

I don't know how it is done, but i received an massive amount of connection request with a wrong session magic.

This is spammed in the log file, i can post the full log if needed, but its about 8mb from a brief view seconds before i closed the server down.

Code: Select all

575.578 Info Router.cpp:276: Unknown packet type received from 109.172.10.205:53663
 575.579 Info Router.cpp:277: Received: 8f ff 93 e4 82 ff 00 01 00 00 ff ff 00 00 05 78 00 00 80 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 13 88 00 00 00 02 00 00 00 02 1c 61 6e 20 00 00 00 00
 575.580 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.581 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.582 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.584 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.585 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.586 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.587 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.588 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.590 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.591 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.48182 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x91b).
 575.593 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.594 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.595 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.597 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.598 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.599 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.601 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.602 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.604 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.605 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.607 Info Router.cpp:276: Unknown packet type received from 109.172.10.205:53663
 575.608 Info Router.cpp:277: Received: 8f ff 7c e9 82 ff 00 01 00 00 ff ff 00 00 05 78 00 00 80 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 13 88 00 00 00 02 00 00 00 02 4e 61 dc 67 00 00 00 00
 575.609 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.610 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.612 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.613 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.614 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.616 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.617 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.619 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.620 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.622 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.46651 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x7eb).
 575.623 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.625 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.626 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.627 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.628 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.629 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.631 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.632 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.633 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.634 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.635 Info Router.cpp:276: Unknown packet type received from 109.172.10.205:53663
 575.636 Info Router.cpp:277: Received: 8f ff f3 ad 82 ff 00 01 00 00 ff ff 00 00 05 78 00 00 80 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 13 88 00 00 00 02 00 00 00 02 98 61 5f d4 00 00 00 00
 575.637 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.638 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.639 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.640 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.641 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.643 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.644 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.645 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.646 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.648 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(256.256.39485 (build 65418, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(512) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0xbcb).
 575.649 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.650 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.651 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.652 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.653 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.654 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.656 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.657 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.659 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.660 Info Router.cpp:319: Received message type(ConnectionRequest) applicationVersion(0.264.20483 (build 49926, win64, alpha)) activeMods() hasPassword(no) connectionRequestID(2573) from 109.172.10.205:53663 with invalid session magic (expected 0x011, was 0x500).
 575.661 Info Router.cpp:276: Unknown packet type received from 109.172.10.205:53663

Edit: This brings not the headless itself down, but the whole root-sever I'm hosting this on is not reachable anymore

[daniel34]

The IP the connections originated from is based in Russia and a quick search reveals that it has been used to DDoS gameservers in the past: https://new.vk.com/wall-27678352_18674?reply=18701

Now the bad: for extreme bagoyuz runes was banned person gregor_builder, who wanted to arrange a vengeance, constantly attacking the new server DDoS attacks.
[...]
From me infa. This muden connected to 7 times per second, thus causing disconnection of all the players.
blacklist = gregor_builder; 109.172.10.205; -1; Banned;

The easiest way for now is probably blacklisting the IP on your server using iptables/Firewall (edit: might not work if the root itself goes down, contact your provider if this continues).

[kovarex]

This is actually a problem, as it can, if done properly abuse servers to ddos other people with big multiplier. I already fixed as part of the multiplayer rewrite (that will probably take place in 0.14)

[Xelephant]

The IP the connections originated from is based in Russia...snip..
The easiest way for now is probably blacklisting the IP on your server using iptables/Firewall (edit: might not work if the root itself goes down, contact your provider if this continues).

Yeah i did find that out myself. Thanks for the info thought. I blacklisted the IP already, but since i can not prevent it from connecting towards Factorio my hand are a bit tied.

Good to hear this is solved for the next big update. =)

[kinnom]

it might also be a good idea to inform the police, as (D)DoS attacks are quite illegal.

[kovarex]

The ddos is fixed. You can still get lot of packets from someone obviously.