KiwiSDR full when Admin panel says it is not?

ChrisSmolinski

Does anyone else notice their KiwiSDR saying it is full when you try to use it, when it really is not per the admin panel? I've been noticing that the last few days. The admin panel says there are two users, but it is full. Or are TDoA users not showing up there?

I have noticed it takes a while for this to happen, like after running overnight. It takes a restart of the KiwiSDR server to "fix" things.

Anyone else seeing this? I do not recall running into this before.

Powernumpty

Refresh the admin connection, don't leave it running on a page that refreshes (DX safest if you are going to leave it open) refresh once a day at least.
Stu

ChrisSmolinski

This is curious. Ever since I got my KiwiSDR, I have kept an admin window open in a browser, never had this problem. I ran a test, and tried it in another browser, same problem after a few hours. Refreshing the admin page does not seem to fix it, but using the "Close all active user connections" Kick button will fix the problem so that all four receivers can be used again. I have the feeling that something has changed in a KiwiSDR update to cause this.

I am going to try another test, and see if it happens even without an admin panel open in a browser.

Powernumpty

Do the logs look clean? I've noticed some slightly strange network traffic that does not show up as a connection but is ongoing (will have to check sdr.hu) I don't get many incomming users so would not notice if it was showing all channels used.

what does the /status page show at the time?

ChrisSmolinski

And of course... now it stopped doing it. I even left the admin page open overnight.

I'll see if it happens again today. Strange, as it was consistently doing it after a few hours.

ChrisSmolinski

I was thinking... the problem went away after I blocked the IP address of the user that has been sending bad commands to all our KiwiSDRs: http://forum.kiwisdr.com/discussion/1670/w-f-and-snd-bad-params#latest

Related?

Powernumpty

Did wonder, that was the reason for my question on logs.
To be fair I've seen the admin page show old data for a bit longer than the junk traffic.
My machine is behind a local proxy so I had assumed stale pages might be related to that.
I certainly refresh the admin page now and then to ensure I'm looking at real data.

The all connections used thing (if not actually the case) surely could be related to the extra strange traffic, seems a bit like sloppy programming from someone who is harvesting data from public SDR's without realising it is filling logs to the point of D.O.S.

ChrisSmolinski

Still fine this morning. I'm chalking it up to the data harvester with their sloppy programming. I certainly recommend folks block them if possible, who knows what other problems they are introducing.

Powernumpty

I wonder if it worth putting the IP address blocked in some descriptive line on SDR.hu, might get them to up their game while at the same time alert others to the log-filling-folly (polite version).

n6gn

Since we don't know for sure yet it isn't an "honest mistake", that seems pretty final. It seems to me a decision between helping kiwi owners to keep things tidy and having them exhibit appropriate responsibility. Given the rather large number of public kiwis that are exhibiting moderate to severe "OV" indication, I'm not confident that most owners are paying much attention. Perhaps there needs to be owners' FAQ somewhere that addresses various housekeeping issues for public receivers.

ChrisSmolinski

Given the rather large number of public kiwis that are exhibiting moderate to severe "OV" indication, I'm not confident that most owners are paying much attention.

In addition to the number that apparently don't even have an antenna connected

This reminds me of a task I have been meaning to do for a while, curate a listing of useful KiwiSDR receivers, at least in the Eastern USA, my main area of interest.

On a related note, I think it would be useful if the /status page, which is just plain text, had some additional information, like what the receivers are tuned to, etc. Stuff that could be obtained without making an actual websockets connection to the Kiwi and tying up a receiver connection.

Powernumpty

Like all problems some good might come of it if sdr.hu radios get a healthcheck.

You're probably both right about public shaming being too much, I guess I've spent a year or two trying to reduce bad traffic to couple of small business web-facing servers, being aggressive on IP ranges has been a good thing in that regard.
I started blocking a few specific problem IP's then /24 masks eventually /16 it's surprising how much of "the internet" you can ignore with very little impact on decent folk.

On the status thing I'd almost be for a /user text page where the user can decide what info they would automatically share (like connected users etc.) but also an area for "Manual status update" without restarts so I could post say five-ten last messages "QRM severe" - with timestamp, "Antenna work" -timestamp etc.

G8JNJ

>
>Does anyone else notice their KiwiSDR saying it is full when you try to use it, when it really is not per the admin panel? I've been noticing >that the last few days. The admin panel says there are two users, but it is full.
>

This just seems to have started on my KiWi's, only two users but "Sorry, the KiwiSDR server is too busy right now".

I waited a while, did various refreshes etc. but it's still showing the same.

Regards,

Martin - G8JNJ

jks

Might be invisible connections (although this isn't supposed to be happening anymore except for very short duration connections like Marco's SNR sampling).

Go to the "log" tab on the admin page. Click the "dump" button. Wait a few seconds. Scroll to the bottom of the log. You'll see a heap of debugging messages. Look at the beginning of the messages that appear after "dump --------". Determine if all the RX channels are busy. E.g. for a 4-channel Kiwi you'll see a message for RX0 - RX3, 8-channel RX0 - RX7 etc. If you see "en1 busy1" the channel is busy with a connection. Note the number "N" after the "connN" value. Now go down to the messages after "CONNS: used X/Y". For each value of N there should be a connN entry for the SND and WF parts of the connection. The user's ip address will be one of the values shown.

If free channels are shown, but you can't connect, then please email me the dump log messages (they'll be in the log file as well) and also screenshot the log messages showing your connect failing (some of these messages are not in the log file so you have to screenshot from the log tab).

jks

Okay, someone sent me a log that shows this new kind of attack. Rapid, multiple connections from the same IP using different port numbers and incomplete API to tie up channels until the existing detection code kicks them off. I'll work on a better solution.

jks

From the v1.317 CHANGE_LOG file:

v1.317  August 26, 2019
    Added to admin network tab a new switch:
        "Prevent multiple connections from the same IP address?"
        Defaults to NO. The check is bypassed for local net connections and those
        requiring a user password. And also for any admin connections.

kp4md

I recently had a similar problem on my KiwiSDR that runs with WsprDaemon.
About 22:50 UTC on 5 July I checked and saw that WsprDaemon had stopped uploading WSPR spots since 16:44 (six hours earlier) that day.
The Kiwi web interface reported that all 8 user channels were busy, but the Status tab in the Admin panel reported the one public user channel was available.
The Kiwi Server Log showed multiple connection attempts from 161.117.57.140 being repeatedly kicked off due to exceeding the connection limit.
The router connection log showed an attack of rapid, multiple connections from that same IP with different port numbers.
I rebooted the KiwiSDR and then caught 161.117.57.140 logged on using the iq display extension as "Tavistock" on the public user channel. 

RX0: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 28126.10 kHz usb z0 0:06:01
RX1: "Tavistock" (161.117.57.140, Tavistock) 13215.00 kHz usb z14 iq_display 0:05:39
RX2: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 10140.20 kHz usb z0 0:06:01
RX3: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 21096.10 kHz usb z0 0:06:02
RX4: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 3570.10 kHz usb z0 0:06:09
RX5: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 7040.10 kHz usb z0 0:06:14
RX6: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 18106.10 kHz usb z0 0:06:08
RX7: "wsprdaemon_v2.9g" (192.168.0.120, unknown location) 14097.10 kHz usb z0 0:06:14

A web search identified the IP address 161.117.57.140 registered to Alibaba, Inc. as the Asia Pacific Network Information Center in Hangzhou, China and 13215 kHz is a United States Air Force ALE frequency.
The Raspberry PI's internet connectivity and time clock setting had apparently been disrupted while an entity in China under the alias "Tavistock" used the KiwiSDR to monitor US military comms.
Since then I have closed public access to my KiwiSDR.  I am aware that governments use web resources to gather foreign military intelligence, but I object to my equipment being used in that manner.