Luigi Auriemma

Hi,

The gaming clan I belong to run a BF1942 server and we have been often getting "server full" when people tried to join.
after a bit of resarch I found this site and it seem we might be suffering from a DOS fake player attack.

Question is, Is there anyway to prevent this attack?

thanks

TheGeezer

yes it's the fake players attack (bf1942fp / bf2fp).
The only way to "limit" it a bit is through the banning of the IP of the attacker but naturally it's enough for him to use a socks solution (or spoofing since if I'm not in error there is no challenge for each connection) to bypass the limitation.
The fake players attack doesn't have a real patch or work-around, only the games which use centralized authentication are not affected by this type of attack.

People do get kicked and banned sometimes when they disrupt the other players, But to cry and use DOS tools to ruin it for other players after is just sad.

There is one player that, when he is kicked or banned, he runs the fake player bug. We have had success by using a tool called NetworkActiv PIAFCTM to capture the attackers IP address. Then we ban his IP addresses through the BF1942 Remote Manager. All of his IP addresses have been out of Asia, mostly Beijing and China. Proxies. This works and has been tested by us. So far, these are the ip addresses he has used, just ban these in your Remote Manager.

admin.addAddressToBanList 218.234.21.33 Perm
admin.addAddressToBanList 217.12.202.108 Perm
admin.addAddressToBanList 61.175.219.230 Perm
admin.addAddressToBanList 221.174.22.7 Perm
admin.addAddressToBanList 202.105.182.87 Perm
admin.addAddressToBanList 221.12.147.80 Perm
admin.addAddressToBanList 218.56.97.177 Perm
admin.addAddressToBanList 222.221.6.144 Perm
admin.addAddressToBanList 60.21.161.73 Perm
admin.addAddressToBanList 59.107.72.72 Perm
admin.addAddressToBanList 60.190.79.24 Perm

I hope this helps you guys out.

Thanks for the info :-)
will pass it on to my clan leaders

I wished there was a way to ban all of Asia through remote manager. This particular player has been a thorn to every server he plays in. He goes in and does everything he can possible do to disrupt gameplay and get kicked. It is an EA conspiracy. EA pays Luigi to come up with stuff to ruin old games, so everyone moves on, lol.

Uhmmm this is not a bad idea for a possible job, I will ask EA if for them it's ok 8-)

Sadly, all of the BF series games (1942, 2, 2142) are plagued with this bug... and EA fails to address the problem. It will probably never be fixed. A simple solution on their end would be to not reserve slots for connecting players until they have passed cd-key authentication. This way, server admins can ban by cd-key hash. And if a player wants to flood, they would need multiple cd-keys that are not server-banned. If they attempt to use a cd-key that is already connecting, they get the normal "cd-key in use" error.

Of course, if EA does this then the community is going to complain and ask why they don't fix other glitches (crashes to desktop, unbalanced jets, getting inside of walls, etc.). I think they know that the games are plagued with a lot of bugs, but they just want to move on and forget about it, making more money with new projects. Because in reality, they aren't making much money anymore on the older BF games, so why bother to fix it? I doubt they even care. It will be interesting to see if DOS join attacks are still possible in BF:Heroes :)

To answer your question, you're going to need to just ban the IP addresses. To detect flooding, open up a packet scanner like Wireshark and filter the traffic so it only shows inbound to your server's port. Look for repetitive udp join-packets from the same IP (usually the data size is are about 13 bytes for 1942). If possible, contact the ISP (usually there is an abuse email and/or phone number in their whois info) and provide them with packet scanning logs of the DOS attack. Also, if you are able to manage some type of access list, you can look for common IP addresses in the same subnet and ban the entire subnet. I know Sethioz said you are potentially denying legitimate clients, but I would rather have that happen than have a server that nobody can join :)

A game with cdkey verification, so theorically not vulnerable to the fake players attack, which instead is affected by this attack is really a shame.
And I highly doubt EA will allow the filling of the player slot after the cdkey authentication since it requires deep modification to the core of the engine... so any new game based on this engine will be probably vulnerable at 99%.

actually its better to use commview. you can set special rules there. for example capture only ''join'' packets and nothing else. you can also make it capture only flooding, like set it to capture only when join packet occurs more than x many times (where x is number of times it have to occur). ofc assuming that server is running in pc/server where you have direct or remote access to the desktop.
btw commview actually allows remote monitoring too (ive never used it, but you can remotly monitor other pc/server once you set things up there)

oh and about game companys..they never do anything, because they simply can't bother with this stuff. they support game for .. maybe year, by fixing bugs by themselves with updates. as far as i know they never even bothered to check any reported bug (goes for all game companys, they never even reply)

You can set up special rules, or filters, in wireshark too. For example:

(ip.dst eq 192.168.1.2) and (udp.port eq 16567) and (data.data eq ab:12:cd:34)

Where IP.DST is the ip address of the server, in my case a local address considering I am behind NAT. UDP.Port is the port of the server. Data.data is the hexidecimal representation of the join packet.

And then just watch for the same IP trying to join multiple times. Typically at this point it will be very easy to spot a flood attack. Legitimate clients aren't going to connect more than once per second (because of them having to click through server full messages, etc.). During a flood, you are probably going to see about 10+ join packets a second.

Wireshark can be set up for remote access too: http://www.pawelko.net/linux/17-Rpcapd- ... lwireshark

Or you can just use VNC if that becomes a hassle.

Last but not least, all this is done with free, open source software :). I'm a bit of a wireshark fanboy, but it is a very nice program... and very customizable. But if CommView does what you need it to do, that is cool too.