Forum

Results 1 to 5 of 5
  1. #1
    Join Date
    April 2011
    Posts
    8

    Server Shutdown, DDOS.

    I have a Teamspeak server with mariadb on ubuntu server 14.04 amd64 in a digitalocean droplet, with no other services.

    I am having issues with ddos attacks on the server, it went all the way to Full Gigabit download attack for 3+ hours with version 3.0.11.3.

    Tried to solve it with anti-ddos service, iptables block on query port and changed the query port and revert to 3.0.11.2.

    I had issues with PktHandler | | detected incorrectly running system clock (>)
    that I think where solved with installation of ntpd and removal of ntpdate.

    I am getting shutdown for no aparent reason

    2015-05-14 20:29:17.071355|INFO | | | Increased protection level to: 1
    2015-05-14 20:30:26.376029|INFO | | | Decreased protection level to: 0
    2015-05-14 22:46:48.983370|INFO |ServerMain | | Received signal SIGHUP, shutting down.
    2015-05-14 22:46:50.926572|INFO | | | Increased protection level to: 1

    The things that got me worried was de attack, after and uptade that said that has improved ddos escalation protection, and the server crash...

    what do I do to mitigate the ddos, and how do I stop the shutdown without any order from me.

    Take in mind most of these issue happen with the new version.

    PS: Forgot to mention I have latest kernel 3.16
    Last edited by phoenixstf; May 15th, 2015 at 01:33 PM. Reason: forgot a detail

  2. #2
    Join Date
    June 2008
    Posts
    18,409
    Quote Originally Posted by phoenixstf View Post
    The things that got me worried was de attack, after and uptade that said that has improved ddos escalation protection, and the server crash...
    Your report differs from what happend in the past. Dou you have more details?


    I think somebody does try to attack both 1. TS Server via Query and 2. the Main Server


    Somebody or something opens more than 10 connection to the server. New connections to the Query will be blocked for 10 seconds (afaik).
    Code:
    2015-05-14 20:29:17.071355|INFO | | | Increased protection level to: 1

    This is a wanted shutdown and no crash.
    This command comes directly from your operation system and it means "The console where TeamSpeak was running on was closed".
    Code:
    2015-05-14 22:46:48.983370|INFO |ServerMain | | Received signal SIGHUP, shutting down.
    Last edited by dante696; May 15th, 2015 at 01:45 PM. Reason: edit for "no crash"
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  3. #3
    Join Date
    April 2011
    Posts
    8
    I do not have information on where the attack was, digitalocean couldn't get that information for me but it was an inbound attack and pretty nasty one to cpu usage skyrocket and incoming traffit hit 900+ Mbps.
    And it has to be teamspeak because besides ssh it is the only service that is running, (mariadb is localhost bound).

    I actually had some issues before with a server in hetzner, I was getting attacks almost on a daily basis they manage to sniff it out and said that they where handling it and reporting it to authorities but that was it.

    All I can do is upgrade to the new version and put tshark running to a log wait for another attack and then give it to you guys, I really want to solve this ddos issue it is getting pretty annoying.

    The shutting down I will try to debug with OS logs,

  4. #4
    Join Date
    April 2014
    Posts
    30
    You could try additionally fail2ban, it was helping me with some ddos problems.

  5. #5
    Join Date
    April 2011
    Posts
    8
    Already have some anti-dos but escalation is the issue, the inbound attack is so big that continues for hours even with the machine completely shutdown.
    This is kind of weird and a problem in ts3 since I can remember.

    Lets hope the dev's can make fix it

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. DDOS Attack on Server
    By Nawaz032 in forum Server Support
    Replies: 1
    Last Post: June 30th, 2015, 04:33 PM
  2. Massive DDOS Attack on Teamspeak 3 server
    By BL3ND in forum Off Topic
    Replies: 3
    Last Post: June 30th, 2014, 09:05 PM
  3. Mitigate DDoS Attack in Teamspeak Server
    By Nicocaps in forum Off Topic
    Replies: 1
    Last Post: November 20th, 2012, 08:35 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •