*DAMN R6 Forum

Leave this topic here so more people see it than in the GhR section.

Ok, here is my problem. There are a lot of pricks that come onto my server, tk the shit out of everyone, and then leave before the game ends so I can't ban them. If I know when they leave, I can do "netstat -n -p tcp" to get a list of all tcp connections and compare it from before and after they leave, thus getting the IP for the little bitch. What I want to do is find an automated way that everytime someone joins my server it will run netstat to get the IP of the person that just joined the game. Then I would throw their name and IP into a database, so I would have info for everyone on the server. Then if anyone makes problems, I can just go IP ban them. Also, if I get this to work, later I would be able to expand the DB and keep stats of kills and such for everyone and put it on a webpage. It could be quite nifty.

So anyone who knows something or is willing to help, find me on GR. Everyone else, quit fucking bitching at me about the server if it is down. If you want to see it up, solve this problem.

     I doubt that there's any way to link GhR and netstat so that netstat would be called when GhR sends a signal. You could use a cron to run netstat every 30 seconds or so, but without some way to associate the GhR username with the IP, it's all fairly useless. The coding ninja way of doing it would be to write a program which accepts connections on the GhR join port, interrogates the client to determine their username, stores the username/IP/whatever other information you want, and then forwards the connection to GhR. I know that I damn sure wouldn't want to write that. Heh.

I recommend setting up a program called Snort. It's a packet sniffer. You can configure it to log only traffic on a certain port so the logs don't get filled with garbage. It sorts all traffic into seperate folders based on IP. It would be fairly simple to write a script that adds the names of the folders to a database. Run a cronjob with that script and you should be set.

To figure out which IPs are the tkers, just compare the time they log in with the logs, it timestamps everything so it should be no problem. It would be much harder to figure out how to find the person's name automatically. That would involve decoding the game data. It's something we could look at if you want though.

If possible I would set this up on a secondary computer on your network so you can watch what's going on easier and so it doesn't eat precious clock cycles.

Thanks for the suggestions guys. Actually, shortly after I posted this, a guy called mono contacted me on GR and gave me some very good suggestions. He also recommend snort amongst other things, so I have gotten a basic setup running. I am able to log all connections to my GhR server, which gives me both their name (plaintext woot!) and IP address. I haven't created a database or automated anything yet, but if anyone acts up I can go ban them manually. And since it takes more effort right now, I'm going to permaban these guys. I'll automate it soon when I have more time.

Bwahaha, the server lives again...

hey ace, if you have a working setup, i'd be interested in having a look at it ... especially the rule patterns or the relecant part of the dumps ... i'll try to catch u in GR, or if u like (or if i could help), drop me a note: monoATspuriousDOTbiz, ty!