Master Server errors

[TNNAcidRain]

Hey there,

I hopped over to check on the server machine, and saw a whole mess of things...

Maybe someone can offer an explanation? I dont think its a big deal. But here is the error (aside from the 30000 rejects, maybe this is a port scan):

http://www.thenerdnetwork.net/support/masterserver.gif

Much thanks!

[Hyper]

I also get these errors. I mailed Zora about it some time ago:

Hi Hyper,

this exact message is generated, when a game server is uplinking with an invalid \hearbeat\ command, one which misses the game server's query port number or one which isn't a number at all. From the source code it looks as if it's completely game server related, not master server related.

If this happens often and you want to track down the reason, you should use a packet sniffer (e.g. Ethereal/Wireshark) and record the traffic from and to your master server. Find an invalid hearbeat request from a game server to your master server.

In fact, sending invalid hearbeat packets could be used as attack towards the master server (log spamming).

How often does it occur (per day/hour/minute)?
Is it a real problem already or only something which should be explained?

Zora




Hyper wrote:
> Hi Zora,
>
> Since my master server has been advertised and has more servers uplinking to it I get some errors at the master server command screen. Possibly it only occurs when the number of connected servers exceed a certain value.
>
> See the screen for details.
>
> Is this a known problem, and are thre any fixes for it?
>
> Regards,
>
> Hyper.
>
>
>
> UMasterServerCommandlet: Unreal Engine Master Server
> Copyright 1999 Epic Games, Inc.
>
> !! Loading Config: MasterServer.ini
> GameName: unreal
> Operation Mode: TCPLink
> !! Loading TextFile Operation Mode Defaults
> TextFile Mode Output:
> !! Loading TCPLink Operation Mode Defaults
> TCPLink Mode Service Port: 28900
> !! Initializing sockets.
> UDP socket bound at port 27900
> TCP socket bound at port 28900
> Listening on TCP socket.
> !! Listening for and servicing messages.
> < Unknown Error Processing Port >3 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >19 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> < Unknown Error Processing Port >50 Rejected: 0
> Approved: 31 Pending: 6 Ignored: 52 Rejected: 0
>
>
>

[Hyper]

I can't remember having had these errors before. A wild guess is that some changes in u227 may be causing these. Another guess is that it has something to do with the increased usage of the master servers since they have been advertised as replacement of the Gamespy master when it went down.

[§tå£kër 3000]

I put a semicolon in fornt of all the masters except gamespy. so for no errors. I have also seen a number of different ip addresses ,anywhere from (5-10 quiries simutanous but different ip ranges) be rejected at the same time because they are not master servers, so it's quite possible exploits are being looked for by a group of instead of a single person.
Ehh sorry Hyper not the same errors you saw on your master server but from my server log. This is something different, but it may be related.

[§tå£kër 3000]

I'm not sure how the master servers work, but if it's a dns, there are several exploits being used in the wild against those type servers.
And a patch is required to help block that.

[TNNAcidRain]

So it is quite possibly just a port scan that is triggering this...

I saw the same problem with the UGHStats, I actually turned it off because it was becoming irritating..

Basically if someone probes the port which UGHStats or the Master Server is running on, UGHStats would write an empty log, and the Master Server just produces an error and rejects it?

Am I understanding it correctly?

[[]KAOS[]Casey]

It should reject the query from an invalid port yeah. it only makes sense by design to do that, but why does it log it? Not sure..