Forum

Results 1 to 8 of 8
  1. #1
    Join Date
    August 2014
    Posts
    5

    TeamSpeak Server Crash 3.0.11.3

    Hello
    i am having a problem with my TeamSpeak 3 Server
    there is an attacker who is using a script that change his Flags very fast and after that CPU usage (Server VPS) go to 80-90% After that Server crash
    there is nothing in Logs i have also tried Ts3 Server version 3.0.11.3 Beta 1 That Attacker told me that he is taking advantage of TeamSpeak 3 Server Bug

  2. #2
    Join Date
    June 2008
    Posts
    18,261
    Just to be sure, because you did post in another thread already and the server in other thread did not crash:
    1. Did your server really crash? I mean the process isn't running anymore.
    2. Is this user connected from a Query? Please check your firewall if there is a connection opened.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  3. #3
    Join Date
    August 2014
    Posts
    5
    some time if attacker do attack of long time then server get auto restart
    and some time if he attack less time (100-200 Seconds) then all clients get STUCK no one can switch channel and VPS CPU usage go to 70-80%

  4. #4
    Join Date
    August 2014
    Posts
    5
    Normally no one can access my Query port because i have install some firewall rules so before using Query port i have to white list that ip address
    so that's why i don't think that he is using Query port.

  5. #5
    Join Date
    June 2008
    Posts
    18,261
    After conversations with a server developer:
    We don't think there is a bug in the server.
    We think there is a missing anti flood setting for users who do change their IP (with country).

    A ticket for this was created. I can not say if this will be added the next days, weeks or months. Or if this will be added at all, maybe this causes a lot of trouble for normal users.
    This must be evaluated in tests first after the anti flood feature was added.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  6. #6
    Join Date
    May 2008
    Location
    germany/berlin
    Posts
    63
    Hello Community

    same problems like first post.

    since a few days my entire server crashes at irregular intervals.
    sitting for a some nights without sleep at this problem.
    the server logs have recorded nothing

    first thought DDoS .

    iptraf log :

    Code:
    Thu May 28 01:11:47 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to 190.ip-37-59-108.eu; dest unrch (port)
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to mail38.dsbra.com; dest unrch (port)
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to 190.ip-37-59-108.eu; dest unrch (port)
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    infinitely.....

    and many many more dns based attacks on this port.

    @debian dedicated server newest teamspeak version

  7. #7
    Join Date
    April 2011
    Posts
    8
    Same kind of issue with 3.11.2 on Ubuntu 14.04 amd64.


    Quote Originally Posted by Glotzkowski View Post
    Hello Community

    same problems like first post.

    since a few days my entire server crashes at irregular intervals.
    sitting for a some nights without sleep at this problem.
    the server logs have recorded nothing

    first thought DDoS .

    iptraf log :

    Code:
    Thu May 28 01:11:47 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to 190.ip-37-59-108.eu; dest unrch (port)
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 t
    Thu May 28 01:11:47 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987o xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to mail38.dsbra.com; dest unrch (port)
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; ICMP; eth0; 70 bytes; from xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu to 190.ip-37-59-108.eu; dest unrch (port)
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from mail38.dsbra.com:27015 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    Thu May 28 01:11:48 2015; UDP; eth0; 46 bytes; from 190.ip-37-59-108.eu:9987 to xxx.xxx.xxxx.xxxx.rev.poneytelecom.eu:9987
    infinitely.....

    and many many more dns based attacks on this port.

    @debian dedicated server newest teamspeak version

  8. #8
    Join Date
    June 2008
    Posts
    18,261
    Upcomming server 3.0.12 will block all packets for some seconds from that user, when he did change his ip really fast.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. [Resolved] teamspeak 3 application android crash crash crash
    By hycksou in forum Android
    Replies: 4
    Last Post: July 5th, 2017, 07:05 PM
  2. [Resolved] Teamspeak Server Crash
    By skinhead in forum Server Support
    Replies: 6
    Last Post: December 6th, 2014, 02:41 PM
  3. Teamspeak 3 Server Crash
    By zivkovic in forum Linux / FreeBSD
    Replies: 8
    Last Post: November 1st, 2013, 08:39 PM
  4. Teamspeak 3 Server Crash
    By TronixX in forum Linux / FreeBSD
    Replies: 1
    Last Post: February 26th, 2013, 01:07 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •