sc_serv keeps crashing

[FrustratedTechie]

Windows Server 2008 R2 Standard
Winamp 5.623
Nullsoft SHOUTcast Source v.2.2.3 [Build 112]
sc_serv2_win32_07_31_2011

Audio is inputted from a soundcard (computer in studio running Myriad links to Shoutcast Server)

The "One For Nunz" plugin isn't working "...One_for_Nunz_v5_1.exe is not a valid Win32 application" (and that was a direct download from his site) so I can't get a list of plugins. I can screenshot them all if it's needed, however.

The issue is, we recently updated the SHOUTCast version, as the radio station required the use of the Radioplayer plugin, and needed the crossdomain.xml for it to work. We install it, get all the streaming set up, everything's working, no problem.

A few weeks later, sc_serv.exe keeps crashing - It seems to be at random times, as far as we're aware, we can't spot a particular pattern. The crash error looks like this:

code:
Problem signature:

  Problem Event Name:	BEX

  Application Name:	sc_serv.exe

  Application Version:	29.7.31.2011

  Application Timestamp:	4e355891

  Fault Module Name:	MSVCR90.dll

  Fault Module Version:	9.0.30729.4148

  Fault Module Timestamp:	4a594c79

  Exception Offset:	00030655

  Exception Code:	c0000417

  Exception Data:	00000000

  OS Version:	6.1.7600.2.0.0.272.7

  Locale ID:	2057

  Additional Information 1:	0a7d

  Additional Information 2:	0a7d0f7e0216161ce6f247544a37bc93

  Additional Information 3:	fdc7

  Additional Information 4:	fdc79a62935086fd37d5586973b60f37



Read our privacy statement online:

  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409



If the online privacy statement is not available, please read our privacy statement offline:

  C:\Windows\system32\en-US\erofflps.txt

Any ideas what this could be? I've google searched/searched this forum, couldn't seem to find anything related to the issue. If there's any information you need that I've missed out, let me know and I'll post it ASAP!

[DrO]

i've moved your thread in to the correct part of the forum - Winamp Tech Support isn't appropriate for SHOUTcast tool issues. this is why the One for Nunz tool won't have any effect for looking up details about the DNAS issue, though it sounds like an incomplete download (since it's come from my site - that tool is my unfortunate responsibility).

regarding the crash, it is likely to be point #6 from http://forums.winamp.com/showthread.php?p=2790357#known though for that you would likely need to look for IP addresses in the range of 61 to 64 being shown as connecting as a client or as a failed source connection for it to be that.

if an IP like that does appear then the quickest fix is to add the IP to be blocked by your firewall.

if not then at least as a starting point the end portion of the log file (up to ~20 lines would be needed to see if that provides a hint before then enabling all debug logging options).

-daz

[FrustratedTechie]

Cheers for moving the topic, sorry it wasn't in the right section.

code:
2012-05-27 11:05:59	sc_serv2	msg:[DST IP:PORT sid=1] Socket error while waiting to send data. err=Connection reset by peer.(10054)

code:
2012-05-17 12:14:40	sc_serv2	msg:[DST IP:PORT sid=1] Socket error while waiting to send data. err=Software caused connection abort.(10053)  

Just in addition, after installing the new sc_serv2/Shoutcast etc, these messages in the Windows Event Viewer are popping up A LOT (with IP:PORT being different IP/Port combinations (no one IP is appearing a massive number of times, however) - do you think sc_serv constantly sending these messages to Windows Event Viewer is causing it to burn out and crash?

code:
2012-05-17 12:09:22	sc_serv2	msg:[CONFIG] Invalid item on line 22  

this message is appearing too, but not as often as the previous two.

[DrO]

Originally Posted by FrustratedTechie

code:
2012-05-27 11:05:59	sc_serv2	msg:[DST IP:PORT sid=1] Socket error while waiting to send data. err=Connection reset by peer.(10054)

code:
2012-05-17 12:14:40	sc_serv2	msg:[DST IP:PORT sid=1] Socket error while waiting to send data. err=Software caused connection abort.(10053)  

the 10053 and 10054 messages are normal and represents a connection (be it source, client or web) ending. they just shouldn't have been output in normal running and have been hidden for when the next release happens.

Originally Posted by FrustratedTechie

Just in addition, after installing the new sc_serv2/Shoutcast etc, these messages in the Windows Event Viewer are popping up A LOT (with IP:PORT being different IP/Port combinations (no one IP is appearing a massive number of times, however) - do you think sc_serv constantly sending these messages to Windows Event Viewer is causing it to burn out and crash?

it won't be causing the crash and really what is reported just before the crash happens is most likely to the culprit triggering the issue. also the logging to event viewer is something that i've changed for the next build to only happen if it's setup to run as a service.

Originally Posted by FrustratedTechie

code:
2012-05-17 12:09:22	sc_serv2	msg:[CONFIG] Invalid item on line 22  

this message is appearing too, but not as often as the previous two.

all i can say is to check what is on that line in the config file as not all v1 settings are usable in a v2 setup and that's usually the trigger for that (or having an entry which is not supported / invalid). i recently changed things internally to make it clearer what the cause of that error is.

-daz

[FrustratedTechie]

Okay, I think I've found the error that appears before the crash. These two happened within 4 seconds of each other last night.

code:
2012-06-27 19:26:43	sc_serv2	msg:[SRC 61.63.39.74:51255 sid=1] connection denied. Bad password.

code:
Faulting application name: sc_serv.exe, version: 29.7.31.2011, time stamp: 0x4e355891

Faulting module name: MSVCR90.dll, version: 9.0.30729.4148, time stamp: 0x4a594c79

Exception code: 0xc0000417

Fault offset: 0x00030655

Faulting process id: 0x85c

Faulting application start time: 0x01cd543bf759eae2

Faulting application path: C:\Program Files (x86)\SHOUTcast\sc_serv.exe

Faulting module path: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\MSVCR90.dll

Report Id: a76c7d8b-c085-11e1-8a66-002655cf69b2

[FrustratedTechie]

Also, as far as I can tell, the 'Invalid Item on Line 22" is

code:
flashpolicyserverport=8000

Which is the entire reason we installed the latest version of Shoutcast, for the flash-based player!

[DrO]

that is one of the known IP addresses to cause the issue. you'll need to block it in the Windows firewall.

flashpolicyserverport is sort of supported if using sc_trans but it's not a supported option in the v2 DNAS _yet_ - it's been confirmed as working against internal builds from a few months back but there has not yet been a new public release with that option available.

-daz

[FrustratedTechie]

Okay, thank you - is the IP some sort of bot that's automatically accessing shoutcast streams? Also, is there a list of IPs that you have available you could PM me so I can speak to my manager about blocking them?

Thanks for your help so far, it's appreciated!

[DrO]

the one you are seeing is the main one. i'm still not 100% what the connection is coming from other than it's not a proper client (as far as the DNAS handling is concerned) and it ends up going down the bugger code path. there's another IP beginning with 64.x.x.x but i cannot find it in my notes or from a search of the forums (throws up too many x64 related posts).

-daz

[FrustratedTechie]

Okay, cheers for that - we're going to block that IP for now, and see if this is the issue. I had a look in our logs, and the IP 64.208.160.254 kept popping up, not sure if that's worth keeping a note of.

[DrO]

if in doubt, the best thing is to block it.

-daz

[FrustratedTechie]

(Possibly) SOLVED!

Since we blocked the IP 61.63.39.74, the stream has been up for over 24 hours, which is beyond the longest time this has happened since the error has appeared - I'll assume this is sorted! I'll probably be on here pestering you again if it reoccurs, however.

DrO, thank you very much for being patient and helping me out!

[thinktink]

The IP address is being reported as coming from Taiwan. I usually block all of the that country's and China's IP addresses whenever I make a new server (whether SHOUTcast related or not.) As far as I know, those two countries are the worst Netizens on the face of the Earth so I'm actually not surprised to its reported origin.

http://whois.domaintools.com/61.63.39.74
http://www.robtex.com/ip/61.63.39.74.html#whois

[DrO]

they might be the worst netziens (or at least seem that way - though i've had more trouble from obnoxious US based people than anyone from that part of the world) but it does seem somewhat excessive but each to their own with how they run / setu their stations

-daz

[thinktink]

Well, when I had a server up, it was mostly attacks against my SSH, HTTP, and SMTP ports with the occasional port scan blurps on the DNAS (mostly saw those on the v1 DNAS, not the v2 DNAS.) The first time I setup Fail2Ban on my server I would get at least 15 e-mails a day about Chinese and Taiwanese attacks against various ports. When I put in the country blocking for those two countries that fell to 1-2 a week.

I never got any legitimate traffic from those countries anyways so it didn't bother me at all to use those "excessive" measures. It's something to consider. Some random script kiddie from China can't bot even the most un-updated and unprotected server if they're just blocked completely.