Author Topic: Coders Please Read...  (Read 6386 times)

Offline reaper

  • Opulent Member
  • *
  • Posts: 2872
  • Nice night for a walk, eh? - Nice night for a walk
    • View Profile
  • Rated:
Re: Coders Please Read...
« Reply #15 on: January 06, 2009, 12:43:27 PM »
The MAC stays local to the ethernet LAN.  So the MAC address your server sees is the routers mac.  If the game uses UDP, it might have something like.. you send a packet and it processes it, and does whatever, and nothing has to be routed back to the client, so it could come from any ip.  Or even the game could accept certain ip's as trusted and you could fake those, and send UDP packets to do whatever, quake had an exploit like that  a long time ago.
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus
VaeVictus "reaper is a lying sack of shit and ragequit then had, probably slugs, come alias and beat me, wasnt even the same person playing OBVIOUSLY, accuracies basicly doubled, and strategy

Offline console

  • Brobdingnagian Member
  • ***
  • Posts: 4518
  • "Man, this is the way to travel," said my attorney
    • View Profile
    • tastyspleen.net
  • Rated:
Re: Coders Please Read...
« Reply #16 on: January 06, 2009, 12:51:57 PM »
The MAC stays local to the ethernet LAN.

In the context of this thread, I took "mac spoofing" to simply mean a technique for immediately leasing a different IP address.

(Because I can't think of any other applicable use of that term in this situation...)

  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus

Offline reaper

  • Opulent Member
  • *
  • Posts: 2872
  • Nice night for a walk, eh? - Nice night for a walk
    • View Profile
  • Rated:
Re: Coders Please Read...
« Reply #17 on: January 06, 2009, 01:21:30 PM »
ah gotcha, so if someone is grabbing new ip's by changing their mac address, something does a reverse lookup on the ip, and bans based on the who owns the ip?

I think the cable companies probably tie their modem/router mac to dhcp, so you can't change the mac on the pc, or modem anymore.  Also  if it is only a one packet attack, how does the hotmask banning initally work.  Only the IP would be in the packet, is some kind of reverse lookup or whois request done before the packet is processed?
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus
VaeVictus "reaper is a lying sack of shit and ragequit then had, probably slugs, come alias and beat me, wasnt even the same person playing OBVIOUSLY, accuracies basicly doubled, and strategy

Offline quadz

  • Loquaciously Multiloquent Member
  • ****
  • Posts: 5352
    • View Profile
  • Rated:
Re: Coders Please Read...
« Reply #18 on: January 06, 2009, 02:34:29 PM »
ah gotcha, so if someone is grabbing new ip's by changing their mac address, something does a reverse lookup on the ip, and bans based on the who owns the ip?

Yes... quake itself doesn't support hostmask-based banning, so I added it to wallfly.

So wallfly does the reverse lookup and matches the hostname against a ban list composed of regular expressions, like:

Dial.*Seattle.*Level3.net
72-225.*rochester.res.rr.com
lsanca.dsl-w.verizon.net

etc.


Regards,

:dohdohdoh:
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus
"He knew all the tricks, dramatic irony, metaphor, bathos, puns, parody, litotes and... satire. He was vicious."

Offline QwazyWabbit

  • Carpal Tunnel Member
  • ******
  • Posts: 1371
    • View Profile
  • Rated:
Re: Coders Please Read...
« Reply #19 on: January 06, 2009, 09:37:48 PM »
Is there an advantage to that vs. just doing a block of xxx.xxx.xxx.000/24 or xxx.xxx.000.000/16? I suppose you don't end up chasing every block he appears on but grabbing whole groups like that could grab some collateral innocents, yes?
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus

Offline console

  • Brobdingnagian Member
  • ***
  • Posts: 4518
  • "Man, this is the way to travel," said my attorney
    • View Profile
    • tastyspleen.net
  • Rated:
Re: Coders Please Read...
« Reply #20 on: January 06, 2009, 10:10:06 PM »
Is there an advantage to that vs. just doing a block of xxx.xxx.xxx.000/24 or xxx.xxx.000.000/16?

Numerous ISP's have insanely dynamic IPs these days.  All four octets change.  Even though technically there's some subnet mask involved, it's rarely obvious to me what it is.

Here's, for example, about one month's worth of IPs from ca.comcast.net:

24.10.12.206
24.130.118.218
24.130.126.181
24.23.253.23
24.4.23.175
24.4.37.251
24.4.92.134
24.5.135.135
24.5.164.52
24.5.213.153
24.5.227.240
24.5.4.232
24.6.96.219
24.7.17.234
24.7.173.43
67.160.238.113
67.161.50.45
67.161.51.198
67.164.40.67
67.166.146.88
67.172.177.77
67.172.186.45
67.180.169.99
67.181.176.29
67.181.176.50
67.182.181.214
67.182.39.59
67.187.172.70
67.188.116.39
69.181.110.209
69.181.128.115
69.181.228.2
71.202.135.140
71.202.176.162
71.202.177.175
71.202.220.60
76.102.176.63
76.102.197.82
76.105.7.53
76.126.87.212
76.20.71.186
98.207.251.94
98.210.102.178
98.210.188.141
98.210.189.193
98.210.38.233
98.210.92.137
98.224.89.45
98.234.116.39

There are actually a couple dozen legit players from that ISP.  But their IPs don't stick to any particular subnet... When a given player's IP changes it might go from 24.130.118.218 one day to 98.210.189.193 the next. :frustration:

And it's not just comcast... seems an increasing number of ISPs are getting crazy dynamic like that... telesp.net.br, tampabay.res.rr.com, etc....

It was becoming a nightmare.  You'd have to block huge swaths of IP subnets, keeping out numerous legit players, just to try to keep one persistent bastard out.


I suppose you don't end up chasing every block he appears on but grabbing whole groups like that could grab some collateral innocents, yes?

wallfly has a way to make exceptions for legit players, once they contact us... I won't go into the details here (consider for example, a custom cvar in their autoexec.cfg...)


Regards,

quadz

  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus

Offline reaper

  • Opulent Member
  • *
  • Posts: 2872
  • Nice night for a walk, eh? - Nice night for a walk
    • View Profile
  • Rated:
Re: Coders Please Read...
« Reply #21 on: January 07, 2009, 11:00:40 AM »
I wonder if it sends the reverse lookup dns request and waits for a response before processing the first packet.  Because I believe some of the attacks involve only a packet or two.  Like send a udp packet containing rcon commands sourced with ip x.
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus
VaeVictus "reaper is a lying sack of shit and ragequit then had, probably slugs, come alias and beat me, wasnt even the same person playing OBVIOUSLY, accuracies basicly doubled, and strategy

Offline Pr0c3550r

  • Swanky Member
  • *****
  • Posts: 643
  • Founder [EoM]
    • View Profile
    • Entourage of Murder
  • Rated:
Re: Coders Please Read...
« Reply #22 on: January 09, 2009, 04:26:53 PM »
NOT A CODER , yet :)

After a quick read of this thread, this comes to mind.

Could it be several individuals using the same nic? Working together ?

Just using the KISS principal here.

Also, reading the input on a solution to this issue was an education.




 8)

« Last Edit: January 09, 2009, 04:44:24 PM by [EoM] Pr0c3550r® »
  • Insightful
    Informative
    Funny
    Nice Job / Good Work
    Rock On
    Flawless Logic
    Well-Reasoned Argument and/or Conclusion
    Demonstrates Exceptional Knowlege of the Game
    Appears Not to Comprehend Game Fundamentals
    Frag of the Week
    Frag Hall of Fame
    Jump of the Week
    Jump Hall of Fame
    Best Solution
    Wins The Internet
    Whoosh! You done missed the joke thar Cletus!
    Obvious Troll Is Obvious
    DO YOU EVEN LIFT?
    DEMO OR STFU
    Offtopic
    Flamebait
    Redundant
    Factually Challenged
    Preposterously Irrational Arguments
    Blindingly Obvious Logical Fallacies
    Absurd Misconstrual of Scientific Principles or Evidence
    Amazing Conspiracy Theory Bro
    Racist Ignoramus

 

El Box de Shoutamente

Last 10 Shouts:

 

|iR|Focalor

November 06, 2024, 03:28:50 AM
 

RailWolf

November 05, 2024, 03:13:44 PM
Nice :)

Tom Servo

November 04, 2024, 05:05:24 PM
The Joe Rogan Experience episode 223 that dropped a couple hours ago with Musk, they're talking about Quake lol.
 

Costigan_Q2

November 04, 2024, 03:37:55 PM
Stay cozy folks.

Everything is gonna be fine.
 

|iR|Focalor

October 31, 2024, 08:56:37 PM
 

Costigan_Q2

October 17, 2024, 06:31:53 PM
Not activated your account yet?

Activate it now! join in the fun!

Tom Servo

October 11, 2024, 03:35:36 PM
HAHAHAHAHAHA
 

|iR|Focalor

October 10, 2024, 12:19:41 PM
I don't worship the devil. Jesus is Lord, friend. He died for your sins. He will forgive you if you just ask.
 

rikwad

October 09, 2024, 07:57:21 PM
Sorry, I couldn't resist my inner asshole.
 

Costigan_Q2

October 09, 2024, 01:35:05 PM
Et tu rikwad?

Please don't feed the degenerate lies of a sexually-perverted devil-worshipping barking dog like Focalor.

Show 50 latest
Welcome, Guest. Please login or register.
November 10, 2024, 08:44:07 AM

Login with username, password and session length