question about a possible bot
im assuming my server is being logged by some scanning tool, but this person/bot has tried joined at least 10+ times. however, they don't actually appear as "name joined the game" "name left the game" in chat, they just seem to be instantly disconnected upon attempt. is this a bot?
note: my server is whitelisted so i am good when it comes to any potential people trying to join and grief/mess around :)
77 Replies
im more curious as to why it repeatedly happens. assuming that it should only try to join one time if it was a bot or something
Its a server scanner
is it normal for it to happen several times
yeah
damn
you can safely ignore them
ok cool
good thing i have a whitelist
:PepeThumbsUp:
Theyre not actually trying to join
im getting the samething, even same username
even if your server was open and public
they just ping every ip in the ipv4 namespace
and see what responds
im aware. i unwhitelisted for a bit to see if it would actually join
(it didnt)
what is that
they just scan every ipv4 ip
is it normal for them to try to join many times
yes
is it ok to ban them
its up to u as a server owner
really?
yeah
Sadly, a ban won't prevent them for pinging your server
You can block them in your firewall tho
what does that mean
if you have one like iptables or similar
im having the same issue on mine but we started crashing on day 2 and timing out
the servers running in ubuntu idk how
but don't worry
its not harmfull
its disconnecting us because our ping is so low though
thats em.. strange
we changed the port and they stopped and were back to normal
but i want a permanent fix
Well, scanners often scan known ports
not just for minecraft, but for other services
You can block them with a firewall, but they will use other ips
is something like "exampleface.com" a port
its the numbers on the end of the ip
ohhhhhh
ok
12345 then?
try something more randomized
oh i was just doing an example thing thats long enough
ye 5 numbers
IT Tools - Handy online tools for developers
Collection of handy online tools for developers, with great UX. IT Tools is a free and open-source collection of handy online tools for developers & people working in IT.
so changing the port will stop it?
no
oh
do you know how to ban their ip from doin stuff to it
Are you hosting your server on a cloud server?
like a vps or something similar?
no its hosted from home
ooo okey
but you are using ubuntu, right?
yeah
oh wait we figured it out
its not showing up in the server logs now
:D!
Ubuntu uses ufw as the firewall, if you want to block an IP from connecting to your server, you would need to add it there.
just in case you need to do that in the future
guys, everyday every 4 or 5 minutes some random dude "cuute" is trying to join my server but gets disconnected. what can it be because it is really hard to read console.
try doing ctrl + a
then d
then sudo block [put ip here]
dont actually put those brackets
maybe
you can do screen -R
to go back into the screen
thanks, but i use minecraft hosting
oh
idk then
thanks anyway
those steps work for ubuntu i think
here is console screenshot
just try to block the ip
from joining
its 20.4.48.76 (says it there in the error message)
banned, but he joined again
can you ip ban
i ip banned
did it work
if you are not hosting from home i dont know what you can do
me when offline mode server
oh okay
No, almost no scanner does this
Scanners usually ping
This one is probably checking if servers are whitelisted in addition to that
well this one is doing it
i changed the port and now everything is good
ip bans does abesloutely nothing
(minecraft ones)
this is the same one i was having issues with
theres no point
bots will just switch to a different ip
Yeah, but it is the only way to block them.
they only used like 3 ips so far
i blocked them all
https://discord.com/channels/348681414260293634/1123360822895329380
This post on how to setup fail to ban for a minecraft server could be of use, as it would ban any ip that unsucessfully connects multiple times in a row
pufferfish is probably the easiest way to make this less annoying
Yes, but this would actually block the pings, as opposed to just ignoring them. This would effectivly stop the server scanner for a bit until they switched ips.
"Until they switched ips"
its not like they actually harm anything, only the disconnect messages are annoying
which pufferfish has a option to fix now, without reducing useful info in console
Yes, but the pings slightly increase bandwidth and also fixes the problem instead of just ignoring it. If you don't want them to get information about the server being online or player count in real time, this would help to fix that.
Sorry, I should say until a different ip is used to scan.
i can promise you the bandwidth usage is not significant at all (a few bytes every few seconds/minutes)
Yes, but is the data being processed and also the attempt to establish a connection slowing the server down? Also its not just a ping request, since it tries to join. What I'm saying is are there not cpu downsides as well?
it'll waste a few clock cycles
i get the logs being annoying but if it wasn't logging then you'd never notice it from bandwidth/cpu usage
So why not implement fail 2 ban? I don't want anyone who is using a scanner to be able to connect to my server with an actual account and I don't want them to be able to get the details of the server and keep it updated.
easiest way is to just set enable-status=false in server.properties tbh
whitelist solves the problem of them connecting with an actual account