Too many unknown connections from your IP

[sharstine]

====================
Unreal Version: 3.2.8.1
====================

Hello,

I have one user who is experiencing the following problem today:

Logging in...
-server.XXXXXXXXX.com- *** Looking up your hostname...
-server.XXXXXXXXX.com- *** Found your hostname
Disconnected from irc.XXXXXXXXX.com
Connecting...
Logging in...
-server.XXXXXXXXX.com- *** Looking up your hostname...
-server.XXXXXXXXX.com- *** Found your hostname (cached)
Disconnected from irc.XXXXXXXXX.com
Connecting...
Logging in...
-server.XXXXXXXXX.com- *** Looking up your hostname...
-server.XXXXXXXXX.com- *** Found your hostname (cached)
Disconnected from irc.XXXXXXXXX.com
Connecting...
Logging in...
Error : Closing Link: [XX.XX.XX.XX] (Too many unknown connections from your IP)
Disconnected from irc.XXXXXXXXX.com

I have a total of 4 servers and 500 users. I've only had two reports of this problem within the last week. Both reports came from different users. The problem occurs on various servers. I am continually monitoring /lusers on each server. One server has unknown connections (about 40), but the other servers don't have any. I keep clearing the unknown connections on that server using /quote clear, but they keep coming back. I don't know if that has anything to do with this particular user. None of the unknown connections that I kill ever match the user's IP.

I got some additional information from the user:
- They connect from one of two java applets (Many users connect fine using both applets)
- They are using only 1 browser and 1 computer at a time

I understand unknown connections are flagged because they don't sent NICK, USER (and optionally PASS) to connect. I asked him to try connecting to a different server in the meantime. Haven't heard back yet, but I still need a permanent solution. I don't understand what is causing this problem. I don't see anything different about his connection versus anybody else. This is what I need to figure out:

1. Why is the user receiving the above error when connecting?

2. Why does one server on my network continually have 20-40 unknown connections? Does it have anything to do with why this user cannot connect?

Thanks for any insight you can provide.

[Stealth]

You're correct in understanding an unknown connection is a connection that has failed to send NICK and USER. An unknown connection will stay open for up to double the duration of the pingfreq specified in your class blocks.

A few things to try:

• Type "/quote close" to close the unknown connections on your server.
• Make sure you limit any "server status" java scripts on your website (these will just add to the unknown connection count).
• Since it appears the applet is failing to connect, you might want to troubleshoot the functionality of it.
• This could also be the result of an ISP playing with/blocking IRC (it's illegal in most places, but still happens)
• If this user is connecting from a work, school, or public internet, IRC may be against their policies and connections to your server may have been blocked.
• Check with your host to make sure a firewall rule which drops packets is not in place affecting that users IP.

That's all I can think about for now and without any more information about this.

[Stealth]

Forgot to mention Unreal limits unknown connections to 3 per IP to minimize DoS attacks that just open up unknown connections to take all the file descriptors (effectively making it so no one can connect).