{"id":21147516,"url":"https://github.com/sparklypower/blockunexpectedpackets","last_synced_at":"2025-06-28T11:05:31.069Z","repository":{"id":107081600,"uuid":"460111302","full_name":"SparklyPower/BlockUnexpectedPackets","owner":"SparklyPower","description":"👮 Preventing BungeeCord CPU overload due to Layer 7 DDoS attacks by scanning BungeeCord's logs","archived":false,"fork":false,"pushed_at":"2022-02-16T17:38:58.000Z","size":2,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-14T14:11:19.606Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SparklyPower.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-16T17:38:49.000Z","updated_at":"2024-06-30T21:34:55.000Z","dependencies_parsed_at":null,"dependency_job_id":"25d43975-0cc6-4e0b-bea6-05edbf6bd32f","html_url":"https://github.com/SparklyPower/BlockUnexpectedPackets","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SparklyPower/BlockUnexpectedPackets","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparklyPower%2FBlockUnexpectedPackets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparklyPower%2FBlockUnexpectedPackets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparklyPower%2FBlockUnexpectedPackets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparklyPower%2FBlockUnexpectedPackets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SparklyPower","download_url":"https://codeload.github.com/SparklyPower/BlockUnexpectedPackets/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SparklyPower%2FBlockUnexpectedPackets/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262419748,"owners_count":23308098,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-20T09:16:48.535Z","updated_at":"2025-06-28T11:05:31.050Z","avatar_url":"https://github.com/SparklyPower.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# BlockUnexpectedPackets\n\nThis script automatically blocks DDoS attacks that are spamming your BungeeCord server with invalid packets.\n\n```\n[08:33:01] [Netty Worker IO Thread #23/ERROR]: [/IpHere:1693] \u003c-\u003e InitialHandler - encountered exception: net.md_5.bungee.util.QuietException: Unexpected packet received during login process! 4554202f20485454502f312e310d0a48\n```\n\nThe script reads the BungeeCord logs and blocks the IP if...\n\n* A unexpected packet was received during login process.\n* If too many read timeouts are triggered in a short period of time.\n\nOf course, you should host your server in a hosting provider that has Anti-DDoS (like OVH)! However if you don't block the IPs in your firewall, your BungeeCord ends up overloading due to too much CPU usage, causing issues to your players.\n\nThis script is very crude, you should use this as base for your own script!\n\n## Using the Script\n\n### Create the IPSet\n\n`/etc/ipset.conf`\n```bash\ncreate badips hash:ip family inet hashsize 1024 maxelem 65536\n```\n\n### Drop invalid IP connections if the IP is present in the `badips` list\n`/etc/iptables/rules.v4`\n```\n# Generated by iptables-save v1.8.5 on Tue Jan  4 14:49:32 2022\n*filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n-A INPUT -m set --match-set badips src -j DROP\nCOMMIT\n# Completed on Tue Jan  4 14:49:32 2022\n```\n\n### Change the `DISCORD_WEBHOOK` variable in the `block_unexpected.py` script\n\nUsed to log blocked IPs and restarts to a Discord channel!\n\n### Create a screen and run the `block_unexpected.sh`\n\nBy default the script will restart every 30 minutes, because the `tail` code stops working if the file is rotated (new day, BungeeCord restart, etc).\n\nI think this could've been handled in a better way, but hey, it works!","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparklypower%2Fblockunexpectedpackets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsparklypower%2Fblockunexpectedpackets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsparklypower%2Fblockunexpectedpackets/lists"}