RCON protocol ignored?

My custom IRC bot used to work perfectly on Legacy and Experimental, but as of 2 days ago, it keeps sending me a Packet Type of number 4, which is impossible according to https://developer.valvesoftware.com/wiki/Source_RCON_Protocol#Packet_Type.

Anyone else having this issue, or better yet… a solution?

On my GSP there’s a file that collects error messages which also display this:

Is there Something in your ServerLog ?

Do you know which file to look for? (Searching atm, but would be faster :stuck_out_tongue: also updated first post, that what you mean?)

theres only about 972397423 posts about this…DDOS

A DDoS can’t control what packet type my server sends out… at most it would make the server unreachable…

Well, its this kind of ddos legacy had early this year, end of last year, just sending false packets to make the server busy, rising its cpu and spam everything to death.

Fine don’t believe me. Doesn’t change what is happening.

Yeah, they’re sending that TO the server. The packet type 4 is coming FROM the server, which a DDoS can’t influence.

@maddyn99 I do see the DDoS attack stuff, but that has nothing to do with the packet type 4…

EDIT: I stated that incorrectly. Maybe it does have something to do with the DDoS and Garry decided to send out a packet type 4 when this occurs. But type 4 is not defined in the official SRCDS RCON documentation, so the question remainds: What’s a type 4 packet?

Just a bad package trying to kill your server / make it inplayable, caused by a wormhole somewhere in the rust coding …

Fixable only through devs … just have a tea … it’s sunday.

Btw, check your servers ram and cpu usage, should make you rolling eyes.

[editline]19th October 2014[/editline]

10% (1.66 GB)

Sorry for being annoying and keep repeating this. But the server SENDS out a packet type 4, this means the type 4 has to be in the code somewhere, so there is someone who put that into the code. Thereby not conforming to the rcon protocol. So where is the documentation on this? And don’t give me the “it’s a ddos” again please… a DDoS sends packets to a server or service in order to overflow it’s TCP/IP stack or make it run out of resources, and therefor not being able to accept new connections. It does not make the server send out a packet type 4, unless the devs coded it this way. Again, thereby not conforming to the rcon protocol.

Related to this post from last year on legacy, there is a way ddos can influence the server, it’s not that normal type of you understand.


To copy/paste from my previous post:
It does not make the server send out a packet type 4, unless the devs coded it this way. Again, thereby not conforming to the rcon protocol.

My goal with this topic was to find out exactly what type 4 is, so I can try to implement it. Not to discuss the recent ddos attacks…

This type 4 does not exist, that’s why the server is banning them for 10 minutes, didn’t read the log above ?

If you just open a tool like rusty, it will spam that message on 204205020020500 ips until your server is freezing. Well, you can rename it to “ is trying to flood my server” but what’s the sense ? it still will freeze.

Well I do appreciate you replying to this thread, I’m starting to wonder if you even know the difference between SENDING a packet and RECEIVING a packet…

[editline]19th October 2014[/editline]

Upon raw packet inspection I realized I was the one being stupid. The server does not send out a packet type 4, it sends out a normal packet type, reporting it has received a packet type 4.
My apologies to SirEb and maddyn99 for being so ignorant.


funny how everyone thinks its DDoS. upon connection when the New connection packet gets received from the server, it tries to read the type as #4 which doesn’t exist in server side code (its depreciated for Group End). Packet length is also slightly different between versions.

Basically they changed the format in which the packet was built in the client, but forgot to include the code server-side to read it properly. - unless somehow along the way the packet got fucked up

also the errors your seeing is the internal rust protocol - nothing to do with RCON. i can only assume your IRC bot is simply printing out errors from the server

So… I could (have been/be) right?

during the packet encoding/decoding process there are 4 wire types (fixed 32, fixed 64, varint and length delimited)
5 = fixed 32
1 = fixed 64
0 = varint
2 = length delimited

when the initial connection packet gets decoded, the type ID it finds is #4 which doesn’t exist, so it doesn’t know what to do with it. I have hooked and tried to make it read the packet using all 4 of the above and no luck, so quite possibly they are using another one (like the depreciated start/end group) or the packet/offsets has just been rooted from something else

[editline]19th October 2014[/editline]


someone wrote something to query all the servers from the steam master server, then spammed connection packets with bullshit data, enough to fill up the max players and deny any more players.

this explains why my local server works fine and others do not?

This is a Layer 7 DDoS Attack. Very cool stuff.