Icecast Streaming Media Server

[karlH]

While icecast can drop those requests, it cannot avoid the minimum setup/teardown cost, icecast will have to close connection even if no content is returned. A firewall can drop a connection from the IP immediately.

I would still need something to work on for this timeout issue to be clear on what the answer is. The DoS attack would certainly affect the listener thread as that accepts the incoming request and matches against the known bad IPs. Without a log I cannot tell if something is reacting badly with that. The deny IP is an avl tree so with that number there is only ~18 IP comparisons, and re-reading the file should only be every few seconds at the most frequent. That last last should limit the re-reading overhead but does leave the possibilities of duplicates going into the file.

karl.

[audiorapture]

I now had to resort to not blocking the attempts at all.

The iptables list I had been using instead of icecast's deny list caused glitches in the audio stream on every insert after about 1,000 entries.

At least the attempts are not being logged anymore in the access log, which is more important to me than blocking the IPs.

Thanks for all your help!

[karlH]

Another idea, although I don't know the effect overall would be to redirect them. Have a listener_add url script return a 200 OK response but add a Location: header sending them somewhere else to timeout eg

Location: http://127.0.0.1:8000/I_NEED_TO_BE BEATEN_UP

This would only work with url auth and whether that timeout helps I don't know. Obviously replacing the IP with the IP of the one causing this would be a nice ending.

karl.

[verl]

I'm getting hit with something similar. It doesn't seem to be effecting anything other then cluttering the log files.


77.64.252.98 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
79.208.23.36 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
88.69.250.99 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
78.35.109.199 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
91.55.71.190 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
95.222.0.233 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
79.246.122.65 - - [14/Apr/2010:10:45:32 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.188.228.46 - - [14/Apr/2010:10:45:33 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.176.113.107 - - [14/Apr/2010:10:45:33 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
77.178.226.32 - - [14/Apr/2010:10:45:33 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
80.153.182.82 - - [14/Apr/2010:10:45:34 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
81.240.125.93 - - [14/Apr/2010:10:45:34 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
78.51.133.135 - - [14/Apr/2010:10:45:34 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
217.83.188.229 - - [14/Apr/2010:10:45:34 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
85.178.68.161 - - [14/Apr/2010:10:45:34 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
217.227.107.235 - - [14/Apr/2010:10:45:35 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.90.161.61 - - [14/Apr/2010:10:45:36 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.176.112.154 - - [14/Apr/2010:10:45:36 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
87.167.149.163 - - [14/Apr/2010:10:45:36 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
83.135.69.47 - - [14/Apr/2010:10:45:36 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
188.194.56.114 - - [14/Apr/2010:10:45:36 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
83.77.56.32 - - [14/Apr/2010:10:45:37 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
91.40.172.187 - - [14/Apr/2010:10:45:37 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
91.54.240.94 - - [14/Apr/2010:10:45:38 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
92.225.17.133 - - [14/Apr/2010:10:45:38 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
70.55.230.114 - - [14/Apr/2010:10:45:38 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
93.232.221.203 - - [14/Apr/2010:10:45:39 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 1
217.224.152.205 - - [14/Apr/2010:10:45:39 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
91.67.134.121 - - [14/Apr/2010:10:45:39 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
92.224.241.161 - - [14/Apr/2010:10:45:40 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
95.208.140.107 - - [14/Apr/2010:10:45:40 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
79.205.107.105 - - [14/Apr/2010:10:45:40 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
79.222.251.222 - - [14/Apr/2010:10:45:40 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
80.121.16.249 - - [14/Apr/2010:10:45:40 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
85.16.210.190 - - [14/Apr/2010:10:45:41 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
87.151.154.85 - - [14/Apr/2010:10:45:41 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
81.51.21.134 - - [14/Apr/2010:10:45:41 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
88.71.56.70 - - [14/Apr/2010:10:45:41 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
80.238.64.8 - - [14/Apr/2010:10:45:42 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
87.173.209.184 - - [14/Apr/2010:10:45:42 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.144.163.9 - - [14/Apr/2010:10:45:43 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 1
78.35.64.88 - - [14/Apr/2010:10:45:43 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
94.221.213.248 - - [14/Apr/2010:10:45:44 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
91.65.209.20 - - [14/Apr/2010:10:45:44 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.164.120.153 - - [14/Apr/2010:10:45:45 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
92.104.242.12 - - [14/Apr/2010:10:45:45 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.61.147.219 - - [14/Apr/2010:10:45:45 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
93.196.180.197 - - [14/Apr/2010:10:45:45 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
79.205.107.105 - - [14/Apr/2010:10:45:47 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
84.139.127.84 - - [14/Apr/2010:10:45:47 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
85.16.60.72 - - [14/Apr/2010:10:45:48 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
77.20.69.177 - - [14/Apr/2010:10:45:49 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
78.242.16.77 - - [14/Apr/2010:10:45:49 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0
80.238.64.8 - - [14/Apr/2010:10:45:49 -0400] "GET /WNSP/index.html HTTP/1.0" 416 46 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 0

[karlH]

My latest code may help in such cases, obviously the people causing these requests could do with been hit hard with a clue stick and fixing that end would be the correct solution but you can try to mitigate the problem to some degree. The problem tends to be down to the fact that these requests occur repeatedly and the ISP changes the IP frequently.

I'm not sure whether the 302 redirect would actually work (it would depend on whether the botnet handles the 302), there was a bug in the auth url code for that which is now fixed but adding that URL load may be an issue in itself.

With www.icecast.pwp.blueyonder.co.uk/icecast-2.3.2-kh22e.tar.gz I've added another option which you can try out. In your xml do

[verl]

Thanks, I'm going to try kh22e now.

Should I be concerned about this?

fserve.c: In function 'open_fh':
fserve.c:231: warning: dereferencing type-punned pointer will break strict-aliasing rules
fserve.c: In function 'fserve_set_override':
fserve.c:936: warning: dereferencing type-punned pointer will break strict-aliasing rules

[karlH]

great warning message, I don't get those here so it may be a gcc version issue, but those lines in question should not pose any issue.

karl.