Why? Because fuck u, thats why: version 70002 , blocks=

[waspoza]

Glad to help.

BTW one of my nodes shows atm:

Code:

`- Total banned:     278

[kingaltcoins]

Why are those IP bans necessary in first place?

As far as I know P2P level increases if we accept more IPs in general.
So what is wrong with accepting them in general?

[waspoza]

They are DDOSing AFAIK.

[fubly]

Perfect!

Since I had implemented fail2ban, my bitcoind did not crash anymore!!!!

It worx


thx to all

also the problem with the gap onto block notify is gone! Now only 1 - 8 sec to realtime



2016-03-07 23:28:35,327 fail2ban.actions: WARNING [bitcoin] Ban 37.78.181.224
2016-03-07 23:36:04,866 fail2ban.actions: WARNING [bitcoin] Ban 93.100.246.134
2016-03-07 23:41:21,205 fail2ban.actions: WARNING [bitcoin] Ban 178.69.189.182
2016-03-07 23:53:35,947 fail2ban.actions: WARNING [bitcoin] Ban 2.61.164.88
2016-03-07 23:59:17,301 fail2ban.actions: WARNING [bitcoin] Ban 77.34.113.161
2016-03-08 00:05:10,677 fail2ban.actions: WARNING [bitcoin] Ban 188.16.121.222
2016-03-08 00:11:04,083 fail2ban.actions: WARNING [bitcoin] Ban 95.188.232.135
2016-03-08 00:16:55,616 fail2ban.actions: WARNING [bitcoin] Ban 46.41.89.230
2016-03-08 00:22:46,982 fail2ban.actions: WARNING [bitcoin] Ban 83.220.94.197
2016-03-08 00:28:17,419 fail2ban.actions: WARNING [bitcoin] Ban 92.37.165.117
2016-03-08 00:32:25,679 fail2ban.actions: WARNING [bitcoin] Ban 46.159.226.38
2016-03-08 00:37:29,999 fail2ban.actions: WARNING [bitcoin] Ban 93.177.34.116
2016-03-08 00:43:10,360 fail2ban.actions: WARNING [bitcoin] Ban 95.159.172.192
2016-03-08 00:48:49,786 fail2ban.actions: WARNING [bitcoin] Ban 77.34.117.93
2016-03-08 00:54:22,144 fail2ban.actions: WARNING [bitcoin] Ban 178.45.42.225
2016-03-08 00:59:49,488 fail2ban.actions: WARNING [bitcoin] Ban 77.35.183.92
2016-03-08 01:05:15,828 fail2ban.actions: WARNING [bitcoin] Ban 79.126.50.153
2016-03-08 01:10:45,175 fail2ban.actions: WARNING [bitcoin] Ban 46.48.180.195
2016-03-08 01:16:10,508 fail2ban.actions: WARNING [bitcoin] Ban 92.126.12.171
2016-03-08 01:21:33,293 fail2ban.actions: WARNING [bitcoin] Ban 5.139.39.28
2016-03-08 01:26:58,629 fail2ban.actions: WARNING [bitcoin] Ban 92.37.224.127
2016-03-08 01:32:28,968 fail2ban.actions: WARNING [bitcoin] Ban 46.42.15.53
2016-03-08 01:37:59,310 fail2ban.actions: WARNING [bitcoin] Ban 37.78.139.238
2016-03-08 01:43:21,657 fail2ban.actions: WARNING [bitcoin] Ban 95.167.114.126
2016-03-08 01:48:49,079 fail2ban.actions: WARNING [bitcoin] Ban 80.234.71.20
2016-03-08 01:54:22,448 fail2ban.actions: WARNING [bitcoin] Ban 176.51.144.213
2016-03-08 01:59:52,807 fail2ban.actions: WARNING [bitcoin] Ban 94.245.159.93
2016-03-08 02:05:23,318 fail2ban.actions: WARNING [bitcoin] Ban 31.180.128.246
2016-03-08 02:10:55,253 fail2ban.actions: WARNING [bitcoin] Ban 178.186.26.235
2016-03-08 02:16:24,642 fail2ban.actions: WARNING [bitcoin] Ban 77.40.29.187
2016-03-08 02:27:15,395 fail2ban.actions: WARNING [bitcoin] Ban 95.189.63.9
2016-03-08 02:38:04,095 fail2ban.actions: WARNING [bitcoin] Ban 5.137.12.245
2016-03-08 02:43:27,467 fail2ban.actions: WARNING [bitcoin] Ban 95.73.160.192
2016-03-08 02:48:55,842 fail2ban.actions: WARNING [bitcoin] Ban 91.147.47.221
2016-03-08 02:54:16,177 fail2ban.actions: WARNING [bitcoin] Ban 2.60.148.209
2016-03-08 02:59:45,640 fail2ban.actions: WARNING [bitcoin] Ban 85.174.90.25
2016-03-08 03:05:11,977 fail2ban.actions: WARNING [bitcoin] Ban 176.51.128.41
2016-03-08 03:10:35,381 fail2ban.actions: WARNING [bitcoin] Ban 95.72.192.151
2016-03-08 03:16:01,715 fail2ban.actions: WARNING [bitcoin] Ban 92.101.147.57
2016-03-08 03:21:29,107 fail2ban.actions: WARNING [bitcoin] Ban 95.169.131.88
2016-03-08 03:26:51,435 fail2ban.actions: WARNING [bitcoin] Ban 92.101.1.116
2016-03-08 03:32:15,774 fail2ban.actions: WARNING [bitcoin] Ban 77.40.85.217
2016-03-08 03:37:45,122 fail2ban.actions: WARNING [bitcoin] Ban 178.44.189.114
2016-03-08 03:48:36,803 fail2ban.actions: WARNING [bitcoin] Ban 213.129.50.88
2016-03-08 03:53:55,128 fail2ban.actions: WARNING [bitcoin] Ban 176.50.195.7
2016-03-08 03:59:21,462 fail2ban.actions: WARNING [bitcoin] Ban 5.158.119.251
2016-03-08 04:04:45,794 fail2ban.actions: WARNING [bitcoin] Ban 94.233.4.91
2016-03-08 04:10:15,134 fail2ban.actions: WARNING [bitcoin] Ban 91.147.33.2
2016-03-08 04:15:32,477 fail2ban.actions: WARNING [bitcoin] Ban 46.48.137.91
2016-03-08 04:21:00,820 fail2ban.actions: WARNING [bitcoin] Ban 5.137.32.79
2016-03-08 04:26:22,156 fail2ban.actions: WARNING [bitcoin] Ban 92.124.35.191
2016-03-08 04:31:46,545 fail2ban.actions: WARNING [bitcoin] Ban 92.101.14.62
2016-03-08 04:37:08,874 fail2ban.actions: WARNING [bitcoin] Ban 217.70.121.180
2016-03-08 04:42:33,209 fail2ban.actions: WARNING [bitcoin] Ban 77.35.36.46
2016-03-08 04:47:54,540 fail2ban.actions: WARNING [bitcoin] Ban 178.187.248.171
2016-03-08 04:53:17,873 fail2ban.actions: WARNING [bitcoin] Ban 95.71.225.14
2016-03-08 04:58:38,213 fail2ban.actions: WARNING [bitcoin] Ban 95.55.213.125
2016-03-08 05:04:02,550 fail2ban.actions: WARNING [bitcoin] Ban 178.187.145.206
2016-03-08 05:09:23,887 fail2ban.actions: WARNING [bitcoin] Ban 178.44.224.106
2016-03-08 05:20:18,637 fail2ban.actions: WARNING [bitcoin] Ban 90.189.57.2
2016-03-08 05:25:43,254 fail2ban.actions: WARNING [bitcoin] Ban 77.35.159.29
2016-03-08 05:31:08,593 fail2ban.actions: WARNING [bitcoin] Ban 79.105.223.3
2016-03-08 05:36:33,934 fail2ban.actions: WARNING [bitcoin] Ban 5.137.56.35
2016-03-08 05:42:04,273 fail2ban.actions: WARNING [bitcoin] Ban 79.126.118.43
2016-03-08 05:47:23,603 fail2ban.actions: WARNING [bitcoin] Ban 94.245.173.143
2016-03-08 05:58:14,360 fail2ban.actions: WARNING [bitcoin] Ban 176.96.187.175
2016-03-08 06:03:35,691 fail2ban.actions: WARNING [bitcoin] Ban 46.48.202.229
2016-03-08 06:09:01,141 fail2ban.actions: WARNING [bitcoin] Ban 178.35.131.78
2016-03-08 06:14:32,484 fail2ban.actions: WARNING [bitcoin] Ban 95.37.143.92
2016-03-08 06:20:00,818 fail2ban.actions: WARNING [bitcoin] Ban 95.37.158.204
2016-03-08 06:25:26,171 fail2ban.actions: WARNING [bitcoin] Ban 109.165.107.95
2016-03-08 06:30:51,512 fail2ban.actions: WARNING [bitcoin] Ban 78.37.60.13
2016-03-08 06:36:12,953 fail2ban.actions: WARNING [bitcoin] Ban 5.138.169.59
2016-03-08 06:41:32,283 fail2ban.actions: WARNING [bitcoin] Ban 31.47.120.146
2016-03-08 06:46:51,615 fail2ban.actions: WARNING [bitcoin] Ban 188.18.26.93
2016-03-08 06:57:33,264 fail2ban.actions: WARNING [bitcoin] Ban 31.23.160.146
2016-03-08 07:02:56,594 fail2ban.actions: WARNING [bitcoin] Ban 178.71.20.220
2016-03-08 07:13:45,250 fail2ban.actions: WARNING [bitcoin] Ban 86.102.7.140
2016-03-08 07:19:07,588 fail2ban.actions: WARNING [bitcoin] Ban 95.72.12.65
2016-03-08 07:24:32,936 fail2ban.actions: WARNING [bitcoin] Ban 178.65.190.51
2016-03-08 07:29:55,296 fail2ban.actions: WARNING [bitcoin] Ban 178.44.192.107
2016-03-08 07:35:16,635 fail2ban.actions: WARNING [bitcoin] Ban 176.209.36.168
2016-03-08 07:40:34,969 fail2ban.actions: WARNING [bitcoin] Ban 176.97.183.219
2016-03-08 07:45:55,306 fail2ban.actions: WARNING [bitcoin] Ban 176.51.62.119
2016-03-08 07:51:17,647 fail2ban.actions: WARNING [bitcoin] Ban 178.34.209.91
2016-03-08 07:56:37,990 fail2ban.actions: WARNING [bitcoin] Ban 178.46.1.205
2016-03-08 08:01:59,332 fail2ban.actions: WARNING [bitcoin] Ban 176.122.62.224
2016-03-08 08:12:49,993 fail2ban.actions: WARNING [bitcoin] Ban 37.122.69.158
2016-03-08 08:18:19,331 fail2ban.actions: WARNING [bitcoin] Ban 92.124.8.205
2016-03-08 08:23:37,660 fail2ban.actions: WARNING [bitcoin] Ban 94.245.141.177
2016-03-08 08:28:56,989 fail2ban.actions: WARNING [bitcoin] Ban 37.23.224.83
2016-03-08 08:34:20,327 fail2ban.actions: WARNING [bitcoin] Ban 37.23.175.129
2016-03-08 08:39:48,669 fail2ban.actions: WARNING [bitcoin] Ban 95.81.218.103
2016-03-08 08:45:11,007 fail2ban.actions: WARNING [bitcoin] Ban 31.23.237.220
2016-03-08 08:50:33,354 fail2ban.actions: WARNING [bitcoin] Ban 37.23.26.108
2016-03-08 08:55:57,695 fail2ban.actions: WARNING [bitcoin] Ban 213.129.52.108
2016-03-08 09:01:23,031 fail2ban.actions: WARNING [bitcoin] Ban 79.126.32.123
2016-03-08 09:06:45,361 fail2ban.actions: WARNING [bitcoin] Ban 94.245.148.51
2016-03-08 09:12:06,717 fail2ban.actions: WARNING [bitcoin] Ban 5.143.69.68
2016-03-08 09:17:34,061 fail2ban.actions: WARNING [bitcoin] Ban 178.64.73.31
2016-03-08 09:22:53,395 fail2ban.actions: WARNING [bitcoin] Ban 87.119.232.193
2016-03-08 09:28:16,729 fail2ban.actions: WARNING [bitcoin] Ban 46.158.92.96
2016-03-08 09:33:41,063 fail2ban.actions: WARNING [bitcoin] Ban 178.186.19.171
2016-03-08 09:39:03,412 fail2ban.actions: WARNING [bitcoin] Ban 95.72.123.163
2016-03-08 09:49:52,077 fail2ban.actions: WARNING [bitcoin] Ban 79.133.142.37
2016-03-08 09:55:12,667 fail2ban.actions: WARNING [bitcoin] Ban 91.147.4.143
2016-03-08 10:00:44,193 fail2ban.actions: WARNING [bitcoin] Ban 88.147.211.84
2016-03-08 10:06:11,536 fail2ban.actions: WARNING [bitcoin] Ban 91.235.187.72
2016-03-08 10:11:36,901 fail2ban.actions: WARNING [bitcoin] Ban 79.105.27.53
2016-03-08 10:17:05,342 fail2ban.actions: WARNING [bitcoin] Ban 92.37.242.229
2016-03-08 10:22:34,679 fail2ban.actions: WARNING [bitcoin] Ban 5.143.96.20
2016-03-08 10:27:59,118 fail2ban.actions: WARNING [bitcoin] Ban 176.51.201.234
2016-03-08 10:33:28,458 fail2ban.actions: WARNING [bitcoin] Ban 213.129.41.225
2016-03-08 10:38:53,793 fail2ban.actions: WARNING [bitcoin] Ban 178.44.129.86
2016-03-08 10:44:20,133 fail2ban.actions: WARNING [bitcoin] Ban 95.70.80.92
2016-03-08 10:49:46,475 fail2ban.actions: WARNING [bitcoin] Ban 79.105.79.126
2016-03-08 10:55:10,819 fail2ban.actions: WARNING [bitcoin] Ban 193.107.0.54
2016-03-08 11:00:36,158 fail2ban.actions: WARNING [bitcoin] Ban 92.37.179.152
2016-03-08 11:06:02,547 fail2ban.actions: WARNING [bitcoin] Ban 93.120.191.174
2016-03-08 11:11:30,326 fail2ban.actions: WARNING [bitcoin] Ban 77.40.64.200
2016-03-08 11:16:56,675 fail2ban.actions: WARNING [bitcoin] Ban 95.71.204.13
2016-03-08 11:27:55,355 fail2ban.actions: WARNING [bitcoin] Ban 213.129.34.214
2016-03-08 11:33:22,696 fail2ban.actions: WARNING [bitcoin] Ban 188.19.52.57
2016-03-08 11:38:48,038 fail2ban.actions: WARNING [bitcoin] Ban 46.48.194.56
2016-03-08 11:44:11,638 fail2ban.actions: WARNING [bitcoin] Ban 95.73.186.144
2016-03-08 11:49:35,983 fail2ban.actions: WARNING [bitcoin] Ban 95.220.46.13
2016-03-08 11:55:05,332 fail2ban.actions: WARNING [bitcoin] Ban 176.209.11.230
2016-03-08 12:00:29,934 fail2ban.actions: WARNING [bitcoin] Ban 5.138.191.242
2016-03-08 12:06:04,282 fail2ban.actions: WARNING [bitcoin] Ban 5.142.214.162
2016-03-08 12:11:29,808 fail2ban.actions: WARNING [bitcoin] Ban 91.147.16.92
2016-03-08 12:16:57,152 fail2ban.actions: WARNING [bitcoin] Ban 95.189.18.5
2016-03-08 12:22:25,504 fail2ban.actions: WARNING [bitcoin] Ban 78.37.33.95
2016-03-08 12:27:52,841 fail2ban.actions: WARNING [bitcoin] Ban 77.35.216.98
2016-03-08 12:33:21,181 fail2ban.actions: WARNING [bitcoin] Ban 77.35.43.189
2016-03-08 12:38:51,520 fail2ban.actions: WARNING [bitcoin] Ban 95.72.175.205
2016-03-08 12:44:17,873 fail2ban.actions: WARNING [bitcoin] Ban 178.207.66.76
2016-03-08 12:49:48,347 fail2ban.actions: WARNING [bitcoin] Ban 85.88.166.142
2016-03-08 12:55:16,703 fail2ban.actions: WARNING [bitcoin] Ban 2.62.193.39
2016-03-08 13:00:50,059 fail2ban.actions: WARNING [bitcoin] Ban 178.184.168.164
2016-03-08 13:06:18,411 fail2ban.actions: WARNING [bitcoin] Ban 5.138.226.123
2016-03-08 13:11:46,766 fail2ban.actions: WARNING [bitcoin] Ban 178.34.17.226
2016-03-08 13:17:12,262 fail2ban.actions: WARNING [bitcoin] Ban 46.63.153.170
2016-03-08 13:22:40,606 fail2ban.actions: WARNING [bitcoin] Ban 178.65.53.11
2016-03-08 13:28:02,939 fail2ban.actions: WARNING [bitcoin] Ban 109.184.228.236

[waspoza]

Nice collection u got there.   

This is mine number currently:

Code:

 `- Total banned:     452

[o_solo_miner]

  and this mine:

Code:

`- Total banned:     629

everybody should do this!

[.anto.]

Since I started to block peers with this offending user agents about 2 weeks ago, I have total unique IPv4 addresses of that peers added into my ipset blacklist which are blocked by my iptables firewall as below.

Code:

root@ledzeppelin:~# cat added_peers_IPv4_with_invalid_user_agent.log | wc -l
1962
root@ledzeppelin:~# 

The total unique IPv4 addresses on my ipset blacklist are actually more as I also block other peers which I don't want to access my node, like the peers with the wrong setup which pretend to access 127.0.0.1:8333 of my node.

Code:

root@ledzeppelin:~# ipset list ipv4blacklist | grep -Ev "Name|Type|Revision|Header|Size|References|Members" | wc -l
6315
root@ledzeppelin:~# 

[jdape]

If this is their attack vector it could be automatically filtered via the log files if needed and blocked via the firewall. A normal node should not request the same block more than once.

Shorena,

You're correct.  The attack vector is not a direct interaction with the bitcoind node.  The attacker is only using that interaction to determine wether the node is running Bitcoin Classic.

If the attacker determines the node is Bitcoin Classic, they are adding the IP address a list of all Classic Node IP addresses.  The attacker then cycles through all the IP addresses in the list and points a DDoS at each IP for about 15 or 20 minutes.  The DDoS is a DNS amplification attack.  The throughput of the attack is approximately 500Mbps.  If the targets' internet downlink is equal to or less than 500Mbps they are effectively blocked from accessing the internet in any way.

Also, if there is more than one Bitcoin Classic node running on the same network there's a good chance you will get two or more attacks at once, increasing the attack throughput to 1Gbps, or more.

https://www.us-cert.gov/ncas/alerts/TA13-088A