Server Protection

[Mac Mcleod]

With the whitelisting of TOPS, I thought I would make some suggestions.

I wrote Harder Cheating for Minecraft which is a server protection mod.

Here is what I do in my mod.

On a chunk by chunk basis, when entities move, a count of chunk entities is performed.    The count is only created once per tick which makes it very light server impact.
If there are too many entities in the chunk, then further entities are prevented from entering the world in that chunk.
If there are way too many entities in the chunk, then further non-player entities are removed from the world without drops.  
This suppresses breeding, breaking lots of chests, using water to push mobs into a single chunk, etc. as a way of killing servers,
An optional report line of where the problem chunk is located is added.

I also check for various other cheat conditions... all once per tick for performance reasons.

From what I hear about the issue on TOPS, a player is sending a request to remove many blocks in a short time period.

That doesn't happen in the other block game because the server doesn't trust the client.
Here is how I would handle it:

Attach a "blocks changed over the last 15 seconds" counter to the player.   If the counter ever exceeds a set limit then report and boot them with a short temporary ban and cancel any queued block changes.  Even roll back their last changes.    In my experience with the game, a non-creative player cannot change more than 1 block per second so you could probably use a configurable "warn" level of 16 blocks and a "tempban" level of 32 blocks.  This is very lightweight (75 counters for 75 players) and the weighty stuff only happens at the warn and tempban level.

Good luck with your issue.  I'm sure you will find a solution to this kind of griefing.
 

[Mac Mcleod]

I was reviewing the mod and I also check the number of mouse and button events coming from the player.  If they exceed a configurable amount per second, then I boot them with a warning message, "you are clicking too fast".  This was to block the auto-recipe loading server attack.    By default, I used 32 events per second as the limit which is well out of normal speed for a human being.

I also check if the client says the player is clicking somewhere too far away from the player.  This is configurable and the default was 12.  This was used to "ping" nether gates in cheat clients to see which players were going through nether gates to locate their bases.

It's a fairly small mod but it relies on config file and line commands and lacks a gui.   
 

[Mac Mcleod]

Oh yes, I did have an include list of items that would be allowed to enter the world even if overcrowded.   These were all player items mostly to cover players dying in an overcrowded chunk but also fat fingering and tossing their premium sword on the ground in an overcrowded chunk.