Glow Command: @dosinfo

Home Documentation MUF Docs GlowMUF Downloads Bug Tracking Support Requests Feature Requests

@DOSINFO

@dosinfo (Wizard only.)

List current denial of service attacks on the server. This command exists because it would be possible for a hacker to connect more than the @tuned max_site_lma times, then remove the initial @tuned max_site_welcome connections, making it impossible to use dinfo to monitor LMA activity. The only hosts listed are those which have a status logged of *DOS indicating they connected more than max_site_lma (usually 40) times in the last minute. If more than 751001216200f max_site_lma connects occur in the past minute, the last minute timer is updated to 'now' if another attempt occurs in under a minute to keep a running tally. If web page requests cause sites to be blocked, up the max_site_lma @tune.

The server has a built in watcher that will start dropping connections from a site the instant they are accepted if more than an acceptable amount occur in a given period of time. If this limit is reached, the site's subnet is 'X' banned under @/sites of room #0, preventing any further accepts from the site unless a wizard clears this property on #0. Once the limit is reached no more connections are logged in the status log to prevent disk filling. (When running on a full attack hundreds of connections can be dropped in a second with no apparent affect on the muck's ability to run.)

LMA = Last minute accepts, LA = Time of last accept, LR = Time of last request, Host = resolved hostname.