Network / Server question

I am stress testing a Java server I've been working on during the last months and that is going to be used to create multiuser/multiplayer applications with Macromedi Flash.

Now, this may sound as the dumbest question ever, but I encountered one problem:

I run a test were a java client was using multiple threads to send lots of messages to the server. Basically the application logs in, joins a chat room and starts sending messages every 300 ms with 50-60 clients.

The peculiarity of the app is that it is not waiting for responses from the server and it does not read them from the socket connection, it just keeps banging the server.

The server receives all these messages and broadcast them to the other "virtual clients" and in no time the output socket of the server is completely full and the server stops sending any message

I know this is a very particular scenario, however this made me think that a hacker could try to do the same and flood the server (maybe using different clients) until he can't send anymore messages.

I am not sure if this is really possible and also how to prevent this. Any ideas ?

An anti flooding check would be a good idea, but I don't think it helps very much if the client on the other side does not read from the socket...

Bytheway the server uses NIO and it uses for output a blocking queue with multiple threads (I guess this is called a "Wrap")

Any suggestion would be highly appreciated :-)

[1507 byte] By [loziopeppino] at [2007-9-30 10:54:00]
# 1
Well, since you can't tell the client off nicely, I'd just be a real ******* about it.When a socket recieves more than X messages per unit of time, kill it in whatever manner you like.-Rejun
Rejun2000 at 2007-7-3 21:37:20 > top of Java-index,Other Topics,Java Game Development...
# 2

yes, I think this is the only solution... since I can't tell if the client is reading the messages from the socket

The anti-flooding filter is certainly a solution, maybe together with a check on how many connections are coming from the same IP address

Limiting to only 1 connection per IP can be limiting for users that are in a LAN, sharing the same connection through a router ... maybe a maximum of 5-10 connections per IP could be good...

I am still a little scared about the fact that a client can send messages at a normal rate (so flooding is not detected) without reading 1 single bit from the socket, if this is repeated by many clients it is likely that the server will not be able to write anymore ...

any other thoughts ? :-)

loziopeppino at 2007-7-3 21:37:20 > top of Java-index,Other Topics,Java Game Development...