A2C_PRINT Exploit

[lolekk1]

Hello,

Im writing about this here because no other sites seem to offer any sort of protection against this exploit.

Currently a friend and I are running a CS:S server, but we are relentlessly being attacked with the A2C_PRINT exploit. Im unable to trace the IP because it is dynamic and bouncing all over the world. I've tried the DOS ATTACKER FIXER plugin, however it doesn't seem like its able to stop the A2C_PRINT exploit. Im pretty sure I have your plugin installed correctly. If it helps, when I type daf_version in my console it shows as "Version:1.1.0.0"

Is there anything I can do or anything you would recommend?

Any help is appreciated,
Jerry

[Drunken F00l]

There's a CVAR daf_block_alla2cprint that should stop it. I'm pretty sure that one is in the readme. You might also want to turn logging off (daf_log 0).

[lolekk1]

Apparently my console doesn't recognize the "daf_block_alla2cprint" as a CVAR. I've tried using it as:

daf_block_alla2cprint
daf_block_alla2cprint 1

Neither seem to work, and I get "Unknown command" returned to me in my console.

Does this plugin need to be used in coordination with any sort of .ini file? Maybe metaplugins.ini

[Drunken F00l]

Ah, the A2C_PRINT spam blocking stuff was added in version 3, but version 3 was never released for the CS:S versions of the plugin.

[lolekk1]

Any plans on releasing that version/patch?

Im sick of this jackass attacking my server.

[Drunken F00l]

Just compiled and uploaded one. Try it and make sure it works:
http://www.sourceop.com/modules.php?...p=getit&lid=36

[lolekk1]

YOUR A FUCKING GOD!

You have no idea how much trouble I've been having with this damn DDOS dude. The jackass was attacking us 24/7 for two days now. Our providers couldn't do shit. Valve doesn't "believe" A2C_PRINT is an issue... *COUGH*

So yes it works and I thank you very much. I owe you big time for all this mental anguish you relieved me of.

------
BTW: I think I know why some of your members are having trouble getting this plugin to work correctly.

The .VDF users download from the site has this in it:

"Plugin"
{
        "file"  "..\cstrike\addons\daf\bin\dosattackfix.dll"
}

when I believe it should be:

"Plugin"
{
        "file"  "..\cstrike\addons\daf\bin\dosattackfix_i486.so"
}

[Drunken F00l]

Actually, if you remove the ".dll" it should add the _i486.so or .dll automatically. You could try confirming if you have a chance.

[lolekk1]

I didn't notice the file auto appending, but the plugin did continue to work if I removed the ".dll"

Thanks again.

[Drunken F00l]

Ya, that's what I meant. Thanks.