Gamespy flood from 75.102.34.20 this morning

Welcome to jdrgaming.com Monday, November 25 2024 @ 06:20 AM PST

Gamespy flood from 75.102.34.20 this morning

Wednesday, August 31 2011 @ 10:37 AM PDT
Contributed by: Jeff Rivett (site admin)
Views: 2,250

At 3:38am this morning, TPU started being flooded with Gamespy traffic from a single IP: 75.102.34.20. The IP is a server in California. It may be just a misconfigured server tracker, or it could be part of an organized DDoS. In any case, I've blocked the IP at the router and notified the person who manages that IP/server.

UPDATE 2011Sep05: The flood from 75.102.34.20 finally stopped, but in the past two days there have been several more, from these addresses:
64.237.43.195
64.79.109.136
71.211.32.58
70.139.49.87

UPDATE 2011Sep06: And more flooding from:
78.46.36.6
72.21.81.63

2011Sep08:
64.79.109.136 (repeat offender)

Gamespy flood from 75.102.34.20 this morning | 15 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Comments are closed and no new posts are allowed.

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Wednesday, August 31 2011 @ 08:05 PM PDT

That is weird. Does that mean another BF server was somehow trying to tap in TPU"s IP without even knowing it? Like how a persons phone line can get walked in sometime?

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Thursday, September 01 2011 @ 09:01 AM PDT

There are a few possibilities. The server at that IP may have been compromised and could be part of a DDoS attack against TPU. A different server could have been compromised and could be part of a DDoS attack against a third server, attempting to using TPU as part of the attack. There could be a misconfigured or misbehaving game server at that IP. However, I think the most likely explanation is that there is some software (probably for monitoring game servers) at that IP that is misconfigured or misbehaving.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Thursday, September 01 2011 @ 09:58 AM PDT

I just read Wikipedia info on distributed denial-of-service attack (DDoS attack) to catch up and understand what it is. I had no idea just how bad it can cause problems until now and hope it wasn't that too. If your right and it is a game monitoring server,could that be Game Tracker being it stop seeing TPU online? GP mention that a lot of servers were down yesterday,could all this be related?

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Thursday, September 01 2011 @ 10:42 AM PDT

The computer at 75.102.34.20 isn't a GameTracker server. It's owned by a server leasing company, so it's probably a game server that also does some server tracking. Actually, I just did a quick search and found that it's a Half Life 2 server. Anyway, yes, there have been a lot of attacks on game servers recently and it's affecting many different games. It's difficult to know for sure what the motivations are, but one of the usual ones probably applies: someone has a beef against a particular server, someone is trying to spread malware for financial purposes, or Internet sociopaths (aka griefers) are just doing what they do: disrupting the online experience for total strangers for no particular reason. As I've said before, when somebody finally figures out how to punch some griefer's snotty little nose through the Internet, they'll stop doing it.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Darkryda
on Thursday, September 01 2011 @ 08:30 PM PDT

here is a question, is it possible to track an ip to the building the griefer is at? if so send me the addresses, ill take care it cause i am bold like that, lol ill punch thru a door, grab them and pull them thru the door, just to talk to them face to face. iv popped a few peoples online bubbles before

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Friday, September 02 2011 @ 08:11 AM PDT

I wish it was that easy. All I have is the IP of the server that is apparently sending the flood traffic. I can't even be 100% certain that the traffic actually originates there, because there could be some IP spoofing going on. Even if the traffic does really originate on that server, the server may be compromised and under the control of some random hacker. The people who actually own and rent out the server don' t control what runs on it. There may be several people administering the server software and content, and managing the game server software. I contacted the company that owns the server and that's as far as I can get. This kind of thing allows me to see why people want the Internet to be more controlled, but I would still rather deal with this kind of problem than give up all possibility of privacy on the Internet.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Friday, September 02 2011 @ 09:11 AM PDT

I agree, I don't mind working for Big Brother but having them really in your face a way from home is way to much. But then again they are already watching anyway. But those who do this really should use their gift in helping people instead of harming them. No wait, we live in a broken world that can't be fixed so we have to just suck it up till they can be locked up for this. You want to know something sad? Those hackers even know it is a felony and still do it anyway. very sad.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Saturday, September 03 2011 @ 09:29 AM PDT

But all I was saying was I don't mind a little bit monitoring,but at home we should have our privacy 100%(like email and other stuff). But in the money world and the mess we see on the internet should be watched over more. True, gaming should be private but with some limitations. My favorite thing I wish the internet had was a super program that can stop those annoying bots that pop up everywhere. Like I can be at any giving site, like facebook and wouldn't you know some bot would pop up and say "hi lets chat" knowing that is not a human, I hate that!

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Tuesday, September 06 2011 @ 03:48 AM PDT

Regards to the update IP's. I shouldn't say this, but it's to bad they can't get a nasty worm to shut them down for poking around places they shouldn't be.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Tuesday, September 06 2011 @ 03:58 AM PDT

I forgot to ask, is it because of these IPs Gametracker shows TPU down when TPU is running fine?

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Tuesday, September 06 2011 @ 09:33 AM PDT

it's to bad they can't get a nasty worm to shut them down for poking around places they shouldn't be.

Yeah, but the problem is figuring out for sure who is initiating the flood and whether it's intentional or just something misconfigured.

---
-- Jeff (boot13)

Edited on Tuesday, September 06 2011 @ 09:35 AM PDT by jrivett

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Tuesday, September 06 2011 @ 09:43 AM PDT

is it because of these IPs Gametracker shows TPU down when TPU is running fine?

Yes. These floods are using the same Gamespy protocol that all the trackers use, and when there's too much traffic of that type it seems to cause trackers to time out. That includes the server manager itself, which often shows "Couldn't get server status! Segment did not contain a queryid" repeatedly during the floods. I'm looking at ways to automatically block (at the router) any IP that sends excessive Gamespy traffic.

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Tuesday, September 06 2011 @ 12:36 PM PDT

aye carumba

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: [TPU]Sisko
on Thursday, September 08 2011 @ 09:38 AM PDT

I have a question. I was in a very curious mind and decided to looked up those IP's and one of them was from Germany, the rest was in the US. If some type of server was misconfigured, would having IP's from two countries rule that out and confirm that this is a hack? Unless if it is a server and having a remote link up?

---
-- Jeff (boot13)

Gamespy flood from 75.102.34.20 this morning

Authored by: Jeff Rivett (site admin)
on Thursday, September 08 2011 @ 10:38 AM PDT

These traffic floods seem to come in waves (no pun intended). My interpretation is that one of the following has occurred:

[1] A new script for disrupting game servers was posted on some hacking site and a bunch of different script kiddies started using it. Likelihood: doubtful.

[2] The admins of several different server monitoring services updated their software to a new version and the new version is buggy. Likelihood: likely.

[3] TPU is being targeted specifically by several separate but coordinated attackers. Likelihood: doubtful.

[4] The disruption to TPU is just collateral damage in a DDoS attack that is actually targeted at a different server. In fact, the intended target may be one of the IPs listed above. Likelihood: very likely.

I'm sure there are other possibilities but those are the ones that come to mind.

---
-- Jeff (boot13)

Edited on Thursday, September 08 2011 @ 10:39 AM PDT by jrivett

Gamespy flood from 75.102.34.20 this morning

Search

TPU Status

TPU Stuff

User Functions

Site Features

Events

All Blog Topics