Would it not be better to have a firewall block it instead of letting it go through to the application?

The application would tell the firewall "block everything coming from this address".

How practical is that? How would you go about implementing that? And is there a way to do it without having administrator privileges for the application process?

Cool. But how would one do it?

Quote:Original post by reptor
Cool. But how would one do it?

Buy a professional router, then configure that. These routers provide access lists, routing tables and more. How it's done precisely depends on vendor and model.

Problem with this approach is that such blocking is fairly slow, and does nothing for spoofed sender IP. Typical DoS will also flood the connection, so blocks must be added higher, usually in data center or with ISP, often it requires failover connections as well, since the ones under attack will likely be saturated. It's not something one can do locally.

Automating such blocks is not the best idea. One could just spam packets with spoofed addresses, and application would start adding them to block lists. Over time, legit users would find themselves unable to connect.


To block individual user, server keeps a hash table. Each time a packet arrives, it checks if sender's address is in that table, and ignores the packet if so.


Now the important question becomes - how to determine who needs to be blocked and why.

Quote:Original post by reptor
Cool. But how would one do it?

That entirely depends on what firewall hardware / software you're using.

Indeed - it could be pretty difficult to determine who should be banned.

The reason why I was asking about it is because I've seen some multi-player server administrators talk about doing it. So I figured if they feel they should be doing it maybe they would appreciate it if the game itself had the capability to help them do that.

Sort of like automating a task that has previously been manual for them. Now, is it worth it, is another question. This is not something I bother myself with too much - I was just being curious if it's actually being done in games and of how much trouble it creates.

Good advice - thanks!

Quote:Original post by reptor

Sort of like automating a task that has previously been manual for them. Now, is it worth it, is another question. This is not something I bother myself with too much - I was just being curious if it's actually being done in games and of how much trouble it creates.

Automatic banning is possible. For various undesirable activities such as botting, farming, spamming, etc. it is already done automatically, at least by the big names. But it helps to have several million users, comprehensive logging of all actions, a good data mining system and conservative criteria.

Then it's just a matter of statistical analysis to determine who fits the profile of undesirable behavior.

There isn't much published about it, since it's part of internal operations, and because same systems are used for other purposes. Ability to analyze social behaviors of large samples is often the business advantage of today's online providers, so it's not something companies like to advertise.

And the second problem is that mathematical models for this process are fairly generic statistics, then it's just a matter of encoding them into whatever infrastructure one runs, and processing results relevant to operator. It's all about having data and analyzing it, the implementation is relatively trivial.

Another reason why these practices aren't publicized much is because they invariably deal with privacy issues. For example, it's possible to correlate number of times user types 'lol' vs. what kind of stuff such user buys in online store, then this can be used to tailor advertising for them.

All big online services are monitored for just about every single detail of user interaction, and bans are by far the most trivial ones. The real value lies in monetization. Network loads and such are much less relevant for companies with solid revenue streams, unless it's a coordinated attack against entire service.