People Crashing Your TFC Connection/Game... ?

Hey All,

Just recently I was in a TFC game/server and a "Player" enters the game. He starts team shooting, rocketing snipers of the sniper deck, armour stripping and just generly beeing really abusive. So as you would expect alot of peeps begin to get peed off with him so I start a kick vote on him and that really sets him of on a rampage...
However even tho I think he may have been cheating I manage to hold my own against him and he gets even more peed off.
I end up switching to the same team he is on, only to find him in the respawn, when he says this to me, and i quote "brb, gonna fix u man, u f****r". So i watch him and he is just standing there dead still in the respawn. He has obviously temporally exited the game to "fix me" as he put it. About 20 seconds later my game crashes... Along with a big chunk of my firewall ! Obviously he somehow managed to do some sort of attack on me which caused my game to crash, something I though would be impossible since I only just downloaded a update for winXP that was supposed to stop people crashing applications using DirectX. Yet he still managed to grash my game...
Now this is where I hope you technically minded wizards can help me.
1) How did this person crash my game, &
2) How can I stop it from happening again.

Thx, all suggestions & ideas welcome, Dave.

need more info first -)

were you playing through steam? or the 'proper' tfc
if you used steam then did steam crash also?

what firewall have you got? and what connection? which ISP?

what do your firewall logs say about the time it happened?

Yes was playing via proper tfc using the server browser u get with tfc.
No steam was involved.
Firewall: ZoneAlarmfree.
Connection: 56k, dynamic ip.
Misc: All uptodate with winxp security updates, Anti-virus & ZA updates.
Full system-wide AVG Scan showed no infections
The ZA logs for the time it happend, as well as all logged events befor
that seem to be missing. Either that or the logs don't go back that far.

Dave.

Not much of an expert but he could of used some kind of Nuker, iirc they can knock out a dial up connection, so it would stop the game.
What version of TFC are you running and have you got ZA up to date?

TFC Version is upto date (Ver 1.1.1.0)
ZoneAlarm is also uptodate.
Nuker, iirc ... ????

nuker - something which sends loads of packets to your comp (basically a DoS attack), iirc - if i remember correctly.. but you knew that ;)...

ok well the 'proper' tfc is a better game BUT its far too easy for some1 to get your ip with it, steam makes it harder with using diff commands to get at that info and having the option of having it masked by the server etc etc

but it sounds like you have been nuked, 56k ppl on windows are dead easy to packet flood, the connection just cant cope and windows just says bleh and rolls over. firewalls wouldnt stop em in this case as tfc keeps the port open

Something with packet filtering would stop it though wouldn't it. I know some routers have it (i think) and my wireless airstations have it.

Sounds like the networking layer in the game was exploited in some way.

Some people need to get a life, or a whack across the head...

Quote:

---

Originally Posted by Kez

Some people need to get a life, or a whack across the head...

---

You speak the truth my friend, stupid "H4x0r5"

Quote:

---

Originally Posted by Kez

Some people need to get a life

---

Says the person who just started a thread about sandwiches and crust allocation? :p

But seriously, I agree with Kez, people who do that sort of thing are just plain stupid and immature.

Quote:

---

Originally Posted by mike_w

Says the person who just started a thread about sandwiches and crust allocation?

---

I VERY nearly actually suggested that these saddo's went and cut sandwiches instead of spoiling TFC, lol.

What's the best way of attempting to prevent such attacks then? My firewall does SPI so I should be able to set up a filter - I don't play TFC any more though, so it doesn't really affect me.

playing at a LAN where is someone crashes your game, you go over and give them a kicking ?

SPI would be a good start, but ideally you'd want something like the fully proxied service a watchguard does for HTTP , where it checks each packet of data for anything dodgy. However HL proxying would probably get confused with an aimbot ?

What is SPI ?
How is it possible to get players ip's via TFC ?

Dave.

SPI is a firewall methodology - statefull packet inspection

I feel sorry for you. The worst thing about this though is that it is probably some little 13 year old loser using one of the tools to cause a dns attack. He probably doesnt have a clue about how it works.

So could I download SPI and patch it to my firewall for added protection ?

Take this with a pinch of salt as I'm a bit rusty but:

You need to only allow packets in from known IP addreses and / or packets that are 'return packets' - i.e. packets that are returned in answer to your queries (your PC makes outgoing connections and only packets coming back in 'on' those connections are allowed in - any inbound connections are dropped)... This is where stateful packet inspection comes in IIRC - basically a 'reply' packet is flagged as such but fake return packets can be created... A stateful firewall will check packets marked as returned packets against outgoing connections - and only if they come from the right IP address and port (and are sent back to the right IP address and port) are they let in. A stateless firewall IIRC only checks the packet to see if it's marked as a 'return' packet (so lets anything in that matches your rules even if isn't for an active connection)...

Blimey... I need to read up on firewalls again... I'll check I'm not talking total BS later / tomorrow and post back if I've made any mistakes.

As far as I'm aware ZoneAlarm (the free one at least) can't do what you need. I can't think of any free programs that can do what you need - I've used WinRoute before and it's not easy to set up but it does work well... I've also used Checkpoint (which is easy to set up) but that's damn expensive...

zonealarm kinda sucks, try sygate, it might have more luck