Internal BUG or DDoS Attack?

[secondlife]

Hello bros,
Im still using the last revision of theforgottenserver 1.2 and one player its causing many problems..

My dedicated info:
64gb RAM
250GB SSD
1gb UpLink.

The problem cause high CPU usage/memory usage/Link Usage.
First, i suspect DDoS attack, but when i use netstat/tcpdump, the max connections at the same IP is 20~40 and i cant confirm this "suspect".
When this occurs, SSH/FTP/HTTP/GAMEPORTS have much latency, i already try another configs firewall/iptables but without success.

Repeat, I still using the last revision of tfs 1.2, other servers may be vulnerable.

Descarted options:
BUG much itens in house.
BUG much itens in stackable tile.
BUG callstack overflow(movements).

This problem not cause shutdown/rollback, only the problems mentioned.
Can be DDoS attack?
Any idea to find this bug?

All suggestions are welcome
Thank you!

 

[imkingran]

Where are you hosting it? The OVH servers in North America were having some very bad problems with lags/connection issues. Last I heard it was still going on, if you are hosting from OVH in North America then that could be the issue.

 

[secondlife]

@imkingran
im still using OVH, but i think does not problem in host.
Exist one player ingame, he is causing this bug.
The player asked me for money rl to stop this. =/
Thank you.

 

[secondlife]

UP!!!

 

[Techrlz]

"i want to fix one problem but i dont know what is the problem"

With this is impossible to help you.

 

[secondlife]

@Techrlz if i dont have more informations of this error, what can I do? lol.. Im asked for suggestions to find this issue, seeing that does not return errors in console, crash, seg fault... nothing.. only much latency ssh connection/game lost connection.

 

[secondlife]

@UP
Exists one method to monitoring tfs(exe) with more details? transfer packets/querys executed etc...

 

[Mkalo]

@UP
Exists one method to monitoring tfs(exe) with more details? transfer packets/querys executed etc...

https://otland.net/threads/things-you-may-not-know.240893/#post-2352397

This may help you find something if its a bugged script.

 

[secondlife]

@MatheusMkalo thank you again bro!!
I will try. Its possible to generate this log in one file .txt? hugs!!

 

[Mkalo]

@MatheusMkalo thank you again bro!!
I will try. Its possible to generate this log in one file .txt? hugs!!

Change print to another function that appends text to a txt file.

 

[secondlife]

@MatheusMkalo its work in tfs 1.2? i've added lib file in data/libs but no success and no errors in console. Thank you!

 

[secondlife]

#UP
I've added this in compat.lua and now works!
Its normally return so much strings in exe? like this

@data/npc/lib/npcsystem/npchandler.lua
@data/npc/scripts/default.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/globalevents/scripts/spawn/raids.lua
@data/globalevents/scripts/spawn/raids.lua
@data/npc/scripts/Xodet.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/globalevents/scripts/spawn/raids.lua
@data/globalevents/scripts/spawn/raids.lua
@data/npc/scripts/default.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/scripts/Xodet.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua
@data/npc/lib/npcsystem/npchandler.lua

 

[Mkalo]

Like I said this is to test to see if there is any bugged script, it will print every lua call so ofcourse it will look like this, you have to look at it when the server is freezing to see if there is something repeating too fast. This is just showing that the npcsystem is being called, most likely someone is talking to a npc. If the server is freezing and its showing this as calls its a exploit in npcs

 

[secondlife]

@MatheusMkalo
only one player online in server (me) and generate this amount querys in npchandler.lua.
im still using npchandler from git repo:
https://github.com/otland/forgottenserver/blob/master/data/npc/lib/npcsystem/npchandler.lua
any idea what may be happening?

 

[Mkalo]

@MatheusMkalo
only one player online in server (me) and generate this amount querys in npchandler.lua.
im still using npchandler from git repo:
https://github.com/otland/forgottenserver/blob/master/data/npc/lib/npcsystem/npchandler.lua
any idea what may be happening?

It could be simply a couple of onThink or onCreatureAppear scripts, but if its not freezing the server its no problem.

Its very unlikely that its a problem in the npcsystem.

 

[secondlife]

@MatheusMkalo
hmm, ok. But the problem is that returns MUCH lines/second, most in npc.
its impossible to check querys correctly.
I can ignore npcs?
"=%[C%]", "@data/npc/.+"

 

[Mkalo]

@MatheusMkalo
hmm, ok. But the problem is that returns MUCH lines/second, most in npc.
its impossible to check querys correctly.
I can ignore npcs?
"=%[C%]", "@data/npc/.+"

Thats why the ignore thing is there, use if you feel like you need.

 

[secondlife]

@MatheusMkalo
Now returns in movements like this D:

@data/movements/scripts/tiles.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/walkback.lua

maybe OnStepIn function also "false" print in console too?

 

[Mkalo]

@MatheusMkalo
Now returns in movements like this D:

@data/movements/scripts/tiles.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/walkback.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/snow.lua
@data/movements/scripts/walkback.lua

maybe OnStepIn function also "false" print in console too?

It is not false... its just printing the function calls, if its making it freeze or not you have to check.

 

[secondlife]

@MatheusMkalo its possible to add in print() the name of player called the function? player:getName() or similar? i have tried without sucess. Thank you!