Jump to content

My Shoutcast/steamcat stream bandwith being hacked?


Recommended Posts

    I have had a live stream on the net for some years now. I use it to test different encoders and other ways to improve the audio. I only keep a limited number of slots open due to legal stuff and bandwith issues. I hate to ban or block someone that is on to listen, but when I find abuse I have no problem turnig off tha lights.

      Below are three users I have been having problems with. those familiar with Shoutcast, steamcast, etc should understand. II support most user agents "Media Players" but in the pas few days have been getting some that look more like a Mac address and a normal player. Normally I would just ban the player in question and forget the issue. well this one is different cause it UA is different each time a client logs on. I only picked 3 from today to show. The interesting trace is #2. I would really like to know what they are trying

        anyway here is what I got.....

These are the log entry ip's and below are the traces....

[dest] <84.56.166.153> Connection Opened (A: 192.168.1.2:8000/) [L: 1] {UA: 4be69191}

[dest] <88.76.87.255>  Connection Opened (A: 192.168.1.2:8000/) [L: 2] {UA: 9c96a298}

14:50:54> [dest] <84.57.216.210> Connection Opened (A: 192.168.1.2:8000/) [L: 5] {UA: 43fa4123}

14:50:55> [dest] <84.57.216.210> Connection Closed [L: 4] {41957905 bytes} (3489 secs)

14:57:14> [dest] <84.57.216.210> Connection Closed [L: 2] {4785209 bytes} (380 secs) RE: Unknown

14:57:39> [dest] <84.57.216.210> [403] (Banned) "Request: GET /" {UA: 58e9593f}

14:57:39> [dest] <84.57.216.210> [403] (Banned) "Request: GET /" {UA: NSPlayer/11.0.6001.7000 WMFSDK/11.0}

14:58:00> [dest] <84.57.216.210> [403] (Banned) "Request: GET /" {UA: 472e11b4}

14:58:04> [dest] <84.57.216.210> [403] (Banned) "Request: GET /" {UA: f987cb7f}

14:58:05> [dest] <84.57.216.210> [403] (Banned) "Request: GET /" {UA: 35aa2895}

=============================

==============================

NeoTrace  Version 3.25  Trace Results

Target: 84.57.216.210

Date: 7/10/2008 (Thursday), 6:50:49 PM

Nodes: 24

Node Data

Node Net Reg IP Address      Location            Node Name

  1    1  -  192.168.1.2    33.118N,  89.055W  delta6

  2    1  -  192.168.1.1    Unknown           

  3    2  -  10.20.52.1      Unknown           

  4    3  1 12.215.19.193  Unknown            12-215-19-193.client.mchsi.com

  5    4  1 12.215.7.2        Unknown            12-215-7-2.client.mchsi.com

  6    5  2 12.122.103.74  Houston            tbr2.hs1tx.ip.att.net

  7    6  2 12.122.21.205  Houston            cr2.hs1tx.ip.att.net

  8    7  2 12.122.28.157  Dallas              cr1.dlstx.ip.att.net

  9    8  2 12.122.18.154  Dallas              tbr1.dlstx.ip.att.net

  10  9  2 12.123.16.193  Dallas              ggr3.dlstx.ip.att.net

  11  10  - 192.205.35.142  28.761N,  81.344W 

  12  11  3  4.68.19.254      Dallas              vlan99.csw4.dallas1.level3.net

  13  11  3  4.69.136.165    Dallas              ae-93-93.ebr3.dallas1.level3.net

  14  11  3  4.69.134.22    Atlanta            ae-7.ebr3.atlanta2.level3.net

  15  11  3  4.69.132.86    WASH D.C.    ae-2.ebr1.washington1.level3.net

  16  11  3  4.69.134.142  WASH D.C.    ae-91-91.csw4.washington1.level3.net

  17  11  3  4.69.134.157  WASH D.C.    ae-92-92.ebr2.washington1.level3.net

  18  11  3  4.69.137.49    PARIS              ae-41.ebr2.paris1.level3.net

  19  11  3  4.69.132.142    Frankfurt am Main  ae-2.ebr1.frankfurt1.level3.net

  20  11  3  4.69.134.1      M

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...