My server has TONS of connections O_O

[ratking]

Hello.

(my english is pretty bad, i'll try to explain what happens to my server).

Well... i have a runuo 1.0 server. When i got all setted up, in the very second that it finishes loading the world, TONS AND TONS of connections appears in the server DOS windows (the black one). and they keep and keep appearing... and i have not gave my ip to anyone yet...

my friends can connect but obviously all is too laggy... cuz of the connections.

PD: all of them can't join because my server has no auto accounts and all says that "encrypted client detected". i think that is because my server only supoort 6.0.1.6 remember that the clients with a higher version have a different encryption.

anyway, i want to know what should i do to stop this connections..

here is a image...



i repeat, all of those connectiosn appear in the very second that de server is up. i dont know any of those ip, i have not gave my ip.

maybe my server appears in a public thing or page? please help me! cuz i'm laggin' bad...

[Melchior]

I checked a lot of those IP numbers, and am a bit confused. This are many IP numbers. Perhaps you should post your \Scripts\Misc\ServerList.cs here. It is possible that you have a created a 'listener' on a combination of Domain Name (IP number) and port that is targeted as some service. If you don't want to publish your ServerList here then PM me with the IP number and port and I'll try to check what it's being targeted for, or if you are using some dynamic IP service like no-ip.com, change your domain name (maybe it has been used by someone else before?) and try to obtain a new IP number from your ISP.

Take a look in /Scripts/Accounting/AccountHandler.cs:

using System;
using System.Collections.Generic;
using System.IO;
using System.Net;
using Server;
using Server.Accounting;
using Server.Commands;
using Server.Engines.Help;
using Server.Network;
using Server.Regions;

namespace Server.Misc
{
	public enum PasswordProtection
	{
		None,
		Crypt,
		NewCrypt
	}

	public class AccountHandler
	{
		private static int MaxAccountsPerIP = 1;
		private static bool AutoAccountCreation = false;
		private static bool RestrictDeletion = !TestCenter.Enabled;
		private static TimeSpan DeleteDelay = TimeSpan.FromDays( 7.0 );

Is auto account creation enabled? If so, I would take a look at how many accounts (and their funny names) are created recently.

[ratking]

Nope, you can't create accounts only admins do.

As an advice, all of those connections keep appearing and appearing, trying to connect (u know, de DOS server window never stops...)

I'll try to post my serverlist...

[Melchior]

I've checked a lot of those IP numbers with Whois and converted them to domain names. Most of them are companies taht are telecom providers and ISP's (around the world) using MNS (Yes (MNS not MSN lol) mail, and have been called spammers. Maybe the computer on which you run the RunUO server has been (or still is ) infected with a relay virus. That would mean that those IP numbers you see are trying to place mail queues on your system and that your system, against your will, is going to relay all kind of spam. Probably the spam listener uses the same port number as RunUO.

[ratking]

OMG

What should i do then :O?

use a firewall?? plz help

[b0b01]

Yup block em, null rout em or something if you can.

[ratking]

with a firewall... uhm

u shure that with a firewall my server will still work?

[Melchior]

No, you just need a different IP number. And you should check your computer for viruses. You should ask your provider to give you another IP number, or mayby you can do that yourself by resetting your router, But I have no idea what type of internet connection you are using at this moment. Is it cable? Is it fixed or dynamic IP number? Does your IP number ever change? Or can you make it change by resetting your router (cable box)? What provider are you using? Do you use a dynamic DNS service?

In the most simple case, you have been given a IP number by your provider that has been used by a spam relay before you got that address. There is a global shortage of IP numbers, so all numbers are being re-used just as with cell phones. What OS are you using?

Edit: If you were to install a firewall at this time, then you would still be targeted by all those companies; you would no longer see them on your RunUO console, but your firewall would probably consume a lot of CPU cycles in blocking all those relay requests. Better first get another IP, and THEN install a firewall (or preferably, on your router).

[Quinox]

You're most likely receiving these connections due to malware on your computer. Run a scan on your computer to remove any such programs. Also, for a more immediate resolution to your connection problems you can switch which port your server uses. Port 2593, RunUO's default port, is also the MNS mail protocol's default port.

[ack-sync-request]

What port is it running on? if its running on a well known service port likek 80, 21, 22 etc its probably bots of some sort. Like if its 22 it is SSH brute force attack bots trying to connect but as soon as they send SSH related commands they just get DCed. The encrypted client error happens whenever a client connects and sends an invalid packet, runuo will assume it is an encrypted client as it can't understand what the data is.

[Melchior]

It's probably just a coincidence that the packets received are interpreted as login requests by Runuo, but at least he is notified that his system is being bombarded by packets from all over the world. Most people don't even check their firewall logs to see just how many packets it needs to block. In this case, installing a firewall and/or changing the port will result in a system that will be exposed to a virtual DoS attack, blocking all those packets. His system (or the previous owner of the IP number) has been misused at some time, and to get rid of those packets he will first of all need to get another IP number, then install and configure a firewall. Even if I knew what type of router he is using, I would not recommend simply enabling the firewall inside that device as a solution, for the same reasons; intensive blocking reduces bandwidth. Depending on the type of contract he has, he could even be paying for spam!