Internal BUG or DDoS Attack?

[secondlife]

Hello bros,
Im still using the last revision of theforgottenserver 1.2 and one player its causing many problems..

My dedicated info:
64gb RAM
250GB SSD
1gb UpLink.

The problem cause high CPU usage/memory usage/Link Usage.
First, i suspect DDoS attack, but when i use netstat/tcpdump, the max connections at the same IP is 20~40 and i cant confirm this "suspect".
When this occurs, SSH/FTP/HTTP/GAMEPORTS have much latency, i already try another configs firewall/iptables but without success.

Repeat, I still using the last revision of tfs 1.2, other servers may be vulnerable.

Descarted options:
BUG much itens in house.
BUG much itens in stackable tile.
BUG callstack overflow(movements).

This problem not cause shutdown/rollback, only the problems mentioned.
Can be DDoS attack?
Any idea to find this bug?

All suggestions are welcome
Thank you!

 

[Mkalo]

@MatheusMkalo its possible to add in print() the name of player called the function? player:getName() or similar? i have tried without sucess. Thank you!

Yes you can get the local variables inside the function, but you will have to do some code to figure out which is the player userdata.

debug.sethook(function()
    local info = debug.getinfo(2)

    local localenv = {}
    local idx = 1
    while true do
        local key, value = debug.getlocal(2, idx)
        if key then
            localenv[key] = value
            idx = idx + 1
        else
            break
        end
    end

    if info and info.source and not isInPatternArray(info.source, ignore) then
        if info.source == "=[C]" then
            print(info.name or "=[C]")
        else
            print(info.source)
        end
    end
end, "c")

This will save all local variables inside the localenv table, so if you have a function like
function onUse(player, item, fromPosition, target, toPosition, isHotkey)

You can find the player userdata in localenv["player"] but it will be different if you named the parameter as anything else.

I don't recommend leaving this on for too long in your server, this doubles the number of lua function calls (as this debug hook is called at every call).