Hi to all

pls could you tell me info about which ports are splatterladder using for scanning servers?

We have to switch ON the firewall on our server becouse a lot of attacks on it and the connectivity was fully blocked by them - ping growed to 1200ms = unplayable.

But after switching firewall ON (and we stoped attacks, ping again about 10ms) our server cannot be scanned by splatterladder - what i understood, but we would like to allow splatterladder to scan the server again so pls could anyone tell me which ports (and TDP/UDP or both) splatterladder using for scanning servers? or could anyone advice other solution to prevent attacks?

Thank you very much for your help!

And i would like to add that we have already allowed ports 27960-27970 (servers runs on 27960 and 27969) and 27950 (idmaster) and 7130 (hlsw default) but still splatterladder see our servers that they are DOWN instead they are running smoothly.

Hi,
the Splatterladder-tracker uses the gameport of the server.
So if your server is joinable by people, SL will be able to track it :)

Please give me the servers adress, so I can take a look on the issue

Regards
Schnoog

The IP is 213.168.184.157 and first server has port 27960 and the second one 27969

people can join servers and you can see them in server list in ET, and i see them in HLSW as well, but splatterladder (and Gametracker and this monitoring page http://cade.datamax.bg/away/ets/mb/all.html too) still cant see them, dont know why (we have sometimes problems that idmaster = et server list so this page http://cade.datamax.bg/away/ets/mb/all.html too didnt see our servers - sometimes one sometimes second one sometimes both of them - but usualy after restarting they become visible and this issue was before installing firewall too and we never had this problem with splatterladder or gametracker)

We have opened ports 27959-27970 and figured out that idmaster is using 27950 and HLSW defaultly using 7130 so we opened these two as well (before this i cant see them in HLSW too)

PS: servers are running from 07:30h to 01:00h UTC+01 (DE,CZ,PL..) and we still trying to do something with firewall etc. so if you cant join it should be becouse of restarting or working on it:) (I´ve asked 5 different people to join our servers despite of it seems that servers are offline and they connected and played normaly, so we know that people can join through firewall).

thank you very much!

Bambus

Puuhh .. a hard nut ;)

I`m not able to get a response to my getstatus queries sent to your server, but it`s no problem to join it at all ......

Please let us know more about server config (the machine running the gameserver) , and the firewall used (+rules).
To go into the deep:
To get the info from a server, a udp paket with #255#255#255#255getstatus is sent to the gameserver, which shoud answer with #255#255#255#255getstatusresponse ALOTOFDATA .

It seems your server (os or gameserver) ignore such requests.
Your server appears in the master-server-list because the hearthbeat sent to it.

OK, next step :)

First to expand my explaination:
ET only handels upd packets (udp -> connectionless protocoll)
To query a server, a data-packet containing a specific string ( looks almost like "yyyygetstatus", but the y are equivalent to the html ent. ÿ or ascii char 255) is sent to the ServerIP:Port.
The gameserver, listening to the specific port, receives this packet and built up the answer, which contains for example the servers name, slotcount, players (if one is online, with ping and xp).
This answer is prefixed with the answer head (yyyygetstatusresponse) and sent back to the client which sent the getstatus packet.

Now to the core problem:
I don`t know the firewall you`re using (never used it before). I don`t know if it writes any logs with dropped incoming traffic...
Can you please take a look on your fw-config, if their is any hint about logging.

Nevertheless:
The OS you`re using, is IMO not a good choice., it`s simply not made for such things. But a nother hint:
-try the standard firewall which comes with the OS and open the ports you need (you listed them in your post before). For dropping incoming traffic on blocked port the system-fw isn`t worse than the one you`re using currently.

thx

to OS, we know that it is not the typical and maybe the best choice but it works more than a year and this was the first problem and (as i wrote in the PM to you) we have couple of other programs which are necessary to run on the server and we dont have a time to figure out how to run them on linux (we tried win7 too:).

We already find the simple solution - all outgoing traffic has been allowed and splatterladder and other monitoring sites works well like before.

so thanks again!