EQEmulator Forums - Possible Login Server Issue

EQEmulator Forums (https://www.eqemulator.org/forums/index.php)

- Support::Windows Servers (https://www.eqemulator.org/forums/forumdisplay.php?f=587)

- - Possible Login Server Issue (https://www.eqemulator.org/forums/showthread.php?t=32733)

Nevermind, it looks like the PEQ LS is actually login.peqtgc.net, which resolves to a different IP.

Code:

C:\Users\Trevius>nslookup login.peqtgc.net

Server:  DD-WRT

Address:  192.168.1.1



Non-authoritative answer:

Name:    peq.peqtgc.net

Address:  67.23.190.82

Aliases:  login.peqtgc.net

So, I am not sure if it is related after-all (probably not), other than maybe some servers aren't using the login.peqtgc.net address.

This is now fully resolved as of about an hour ago.

The issue was in our Toplayer appliance that was implemented on 12/19, due to a rule automatically in place for port 5998 typically used for the Borland service. The rule blocked certain packets due to a buffer overflow vulnerability that would have crashed that specific software. Since we do not run Borland, this rule was disabled.

Quote:

Description EXPLT: Borland InterBase Remote Buffer Overflow Exploit
This rule is triggered when an exploit of the Borland InterBase database service (ibserver.exe) in Borland InterBase 2007 before SP2 is detected. The exploit allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp

Thank you very very much for everyone who contributed to resolving this issue. Very awesome work.