localhost got banned (flood protection) although ip 127.0.0.1 is whitelisted

[maxi1990]

Hey there,

I just happened to witness very odd behaviour:
My ts3server instance has been running for some weeks now and I got some cronjobs monitoring packetloss, usercount and checking for updates and so on (I'm using the TS3 PHP Framework).

Today at 16:56 all my cronjobs, which are being executed every 1 and 5 minutes, reported (beginning at the first one):

Error 3329: connection failed, you are banned (you may retry in 545 seconds)

This behaviour is very very strange as my whitelist definitely contains ip 127.0.0.1 (localhost).

Serverlog:

2012-06-28 06:35:53.116291|INFO    |ServerLibPriv |   | TeamSpeak 3 Server 3.0.6.1 (2012-06-27 04:37:54)
2012-06-28 06:35:53.117779|INFO    |DatabaseQuery |   | dbPlugin name:    MySQL plugin, (c)TeamSpeak Systems GmbH
2012-06-28 06:35:53.117811|INFO    |DatabaseQuery |   | dbPlugin version: 1
2012-06-28 06:35:53.242564|INFO    |Accounting    |   | Licensing Information
2012-06-28 06:35:53.242611|INFO    |Accounting    |   | type              : Non-profit
2012-06-28 06:35:53.242643|INFO    |Accounting    |   | starting date     : Mon Dec 19 00:00:00 2011
2012-06-28 06:35:53.242659|INFO    |Accounting    |   | ending date       : Fri Dec 21 00:00:00 2012
2012-06-28 06:35:53.242674|INFO    |Accounting    |   | max virtualservers: 10
2012-06-28 06:35:53.242687|INFO    |Accounting    |   | max slots         : 512
2012-06-28 06:35:53.253130|INFO    |FileManager   |   | listening on 0.0.0.0:30033
2012-06-28 06:35:53.464137|INFO    |CIDRManager   |   | updated query_ip_whitelist ips: 127.0.0.1, 
2012-06-28 06:35:53.464488|INFO    |Query         |   | listening on 0.0.0.0:10011
2012-07-01 00:02:53.133978|INFO    |VirtualSvrMgr |   | executing monthly interval
2012-07-01 00:02:53.134367|INFO    |VirtualSvrMgr |   | reset virtualserver traffic statistics
2012-08-01 00:02:53.134133|INFO    |VirtualSvrMgr |   | executing monthly interval
2012-08-01 00:02:53.170819|INFO    |VirtualSvrMgr |   | reset virtualserver traffic statistics

The whitelist hasn't been changed since start:

[email protected]:[~]
[17:16:25] > ls -la | grep whitelist
-rw-r--r--  1 ts   users      54 Jun 23 23:24 query_ip_whitelist.txt

I cannot explain why localhost got banned by flood protection in the first place and maybe someone experienced similar problems.

[maxi1990]

I now wrote a small "stresstest" script and ran it several times in a row:

#!/usr/bin/php
<?php

require_once("/home/users/ts/accounting/libraries/TeamSpeak3/TeamSpeak3.php");
try {
  $instance = TeamSpeak3::factory("serverquery://serveradmin:[email protected]:10011/");

  $adapter = $instance->getAdapter();
  $cmd = $adapter->prepare("whoami");

  for($i = 0; $i < 200; $i++) {
    $adapter->request($cmd);
  }

  echo sprintf("Command count: %s\n", $adapter->getQueryCount());
  echo sprintf("Runtime: %s\n", $adapter->getQueryRuntime());
  
} catch (Exception $e) {
  fprintf(STDERR, "Error " . $e->getCode() . ": " . $e->getMessage() . "\n");
  exit(1);
}

?>

which results in something like

[email protected]:[~]
[17:48:27] > ./testing.php
Command count: 201
Runtime: 8.1965508460999

without getting banned.
Flood settings are set to: 50 commands, limit 5 seconds, ban time 600 seconds.

[Vasher]

Did you ever figure out the cause? I'm having the same problem even though the ip is on the whitelist.

[maxi1990]

Not yet :/
I had this issue only the one time and I cannot reproduce it.
Do you have any idea what actions could cause the localhost getting banned?

[ARCHI]

If the "script" uses external IP f.e. 1.1.1.1 instead of 127.0.0.1 to connect it can cause such thing. Because if your Ip is f.e. 1.1.1.1 and you connect through 1.1.1.1 then 1.1.1.1 ip isn't whitelisted while 127.0.0.1 is.

[maxi1990]

I just checked: Every of my scripts uses this line to connect:
$instance = TeamSpeak3::factory("serverquery://serveradmin[email protected]:10011/");
But even when you use localhost we should be fine.

[maxi1990]

You won't believe it but the same minute I submitted the last posting, this error happened again. Banned for 10 minutes.

I guess I will have to enable all possible server-side logging in order to figure out what is possibly going on.