<p>Do the dump with -nvvXS.... Those just looks like statusresponse </p>
<div class="gmail_quote">Il giorno 07/gen/2012 09:34, "RedDragon" <<a href="mailto:reddragon@efc-funclan.de">reddragon@efc-funclan.de</a>> ha scritto:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Hi guys,<br>
a filter by lenght isn't a good solution. Here's a sample from the
abuse message<br>
<pre>2011-12-25 13:37:59.270429 GMT ip 46.4.18.xxx.9841 > 208.110.65.xx.20480: UDP (566 bytes) [#0]
2011-12-25 13:37:59.274127 GMT ip 46.4.18.xxx.24685 > 208.110.65.xxx.20480: UDP (575 bytes) [#0]</pre>
As u can see the lenght is even longer then 42-43 bytes. <br>
<br>
The patch from ryan disable its self after some time. Posted before
in this list.<br>
<br>
Hope for a dll or somthing solution. Packetfiltering by an firewall
isn't a good solution for me.<br>
<br>
Greetz<br>
RedDragon<br>
<br>
Am 07.01.2012 00:38, schrieb NewLight Systems:
<blockquote type="cite">
Previous versions where affected by xfire or hlsw ( windows )<br>
<br>
In linux, Ryan's patch is ok, but there are more gameservers
affected (ET, COD2, CODMW, CODWAW, and all Quake based.. )<br>
<br>
El 07/01/12 0:34, John escribió:
<blockquote type="cite">
David,<br>
<br>
Here's another link to a copy of the Windows tool, if you don't
want to register for an account on the TCAdmin forums: <a href="http://files.nfoe.net/download.php?fname=./cod4/CoD4_Getstatus_Flood_Fix.zip" target="_blank">http://files.nfoe.net/download.php?fname=./cod4/CoD4_Getstatus_Flood_Fix.zip</a>.
I don't know if it's the very latest, though (it's v3). <br>
<br>
For Linux hosters, the best option is probably to use Ryan's
patch -- unless you are running something other than 1.7: <a href="http://treefort.icculus.org/cod/cod4-lnxsrv-query-limit-test.tar.bz2" target="_blank">http://treefort.icculus.org/cod/cod4-lnxsrv-query-limit-test.tar.bz2</a><br>
<br>
-John<br>
<br>
On 1/6/2012 2:46 PM, STIPE Administrator wrote:
<blockquote type="cite">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I
keep getting attacked by other game server companies
who run COD on windows - and they would really like
this DLL fix..<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Does
anyone know where it can be downloaded?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Somebody
gave me a link to a working dll fix for widnows last
week but the website was most likely ddos attacked and
forced to shutdown.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="http://rankgamehosting.ru/index.php?showtopic=1320" target="_blank">http://rankgamehosting.ru/index.php?showtopic=1320</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">somebody
is really trying hard to prevent the fix for this
spreading out.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext" lang="EN-US">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext" lang="EN-US"> NewLight Systems [<a href="mailto:nls@newlightsystems.com" target="_blank">mailto:nls@newlightsystems.com</a>]
<br>
<b>Sent:</b> Saturday, 7 January 2012 6:44 AM<br>
<b>To:</b> Call of Duty server admin list.<br>
<b>Subject:</b> Re: [cod] COD 4 UDP security leak<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">There's a dll that fixed that on
windows and iptables rules on linux<br>
<br>
El 06/01/12 20:08, Bong escribió: <u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Our servers are also down now untill there is a fix but i
am also on a win server :( <br>
-----Original Message----- From: RedDragon <br>
Sent: Friday, January 06, 2012 9:33 AM <br>
To: Call of Duty server admin list. <br>
Subject: [cod] COD 4 UDP security leak <br>
<br>
Hi Guys, <br>
is there a practical solution to fix the udp security
problem? Our <br>
servers were also a target. <br>
We have turned off the servers for now till a logtime
solution patch is <br>
out there. <br>
<br>
@rayn <br>
Is it possible to release the last quick patch as an
offical one? <br>
<br>
Greetz <br>
RedDragon <br>
_______________________________________________ <br>
cod mailing list <br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a>
<br>
<br>
<br>
--- <br>
avast! Antivirus: Inbound message clean. <br>
Virus Database (VPS): 120106-0, 06/01/2012 <br>
Tested on: 06/01/2012 19:00:41 <br>
avast! - copyright (c) 1988-2012 AVAST Software. <br>
<a href="http://www.avast.com" target="_blank">http://www.avast.com</a>
<br>
<br>
<br>
<br>
<br>
--- <br>
avast! Antivirus: Outbound message clean. <br>
Virus Database (VPS): 120106-0, 06/01/2012 <br>
Tested on: 06/01/2012 19:08:07 <br>
avast! - copyright (c) 1988-2012 AVAST Software. <br>
<a href="http://www.avast.com" target="_blank">http://www.avast.com</a>
<br>
<br>
<br>
<br>
_______________________________________________ <br>
cod mailing list <br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a>
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">-- <br>
<br>
<u></u><u></u></p>
<p><u></u> <u></u></p>
<p><b>David Aguilar Valero</b><u></u><u></u></p>
<p>Dpto. Comercial y Soporte técnico<u></u><u></u></p>
<p>NewLight Systems<u></u><u></u></p>
<p><b>Servidores de juegos, HW, Dedicados</b><u></u><u></u></p>
<p><u></u> <u></u></p>
<p><span><a href="mailto:c" target="_blank"><b>crk01@nls.es</b></a></span><u></u><u></u></p>
<p><span><a href="mailto:crk01@newlightsystems.com" target="_blank">crk01@newlightsystems.com</a></span><u></u><u></u></p>
<p><span><a href="mailto:tecnico@newlightsystems.com" target="_blank">tecnico@newlightsystems.com</a></span><u></u><u></u></p>
<p>#NewLight_Systems @ <a href="http://irc-hispano.org" target="_blank">irc-hispano.org</a><u></u><u></u></p>
<p><span><a href="http://www.newlightsystems.com/" target="_blank"><b>www.newlightsystems.com</b></a></span><u></u><u></u></p>
<p><span><a href="http://www.nls.es/" target="_blank"><b>www.nls.es</b></a></span><u></u><u></u></p>
<p>This email and any files or attachments
transmitted with it are intended solely for the use of
the intended recipient. This email is confidential and
may contain legally privileged information. If you are
not the intended recipient you should not read,
disseminate, distribute, or copy this email. If you have
received this email in error, please notify the sender
immediately and delete it from your system.<u></u><u></u></p>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
cod mailing list
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<br>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
cod mailing list
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<br>
<div>-- <br>
<p><br>
</p>
<p><b>David Aguilar Valero</b></p>
<p>Dpto. Comercial y Soporte técnico</p>
<p>NewLight Systems</p>
<p><b>Servidores de juegos, HW, Dedicados</b></p>
<p><br>
</p>
<p><span><a href="mailto:c" target="_blank"><b>crk01@nls.es</b></a></span></p>
<p><span><a href="mailto:crk01@newlightsystems.com" target="_blank">crk01@newlightsystems.com</a></span></p>
<p><span><a href="mailto:tecnico@newlightsystems.com" target="_blank">tecnico@newlightsystems.com</a></span></p>
<p>#NewLight_Systems @ <a href="http://irc-hispano.org" target="_blank">irc-hispano.org</a></p>
<p><span><a href="http://www.newlightsystems.com/" target="_blank"><b>www.newlightsystems.com</b></a></span></p>
<p><span><a href="http://www.nls.es/" target="_blank"><b>www.nls.es</b></a></span></p>
<p>This email and any files or attachments
transmitted with it are intended solely for the use of the
intended recipient. This email is confidential and may contain
legally privileged information. If you are not the intended
recipient you should not read, disseminate, distribute, or
copy this email. If you have received this email in error,
please notify the sender immediately and delete it from your
system.</p>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>_______________________________________________
cod mailing list
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<br>
</div>
<br>_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org">cod@icculus.org</a><br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br></blockquote></div>