Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently running a game server on port 27015 under debian. According to the output of:

tcpdump -n -i any dst host xx.xxx.xxx.xxx

The server is getting flooded with:

19:34:48.388401 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0 19:34:48.388405 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0 19:34:48.388407 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0

And the ping of the game server is hitting 1000+ (only affecting the server running on this port on this ip, not the whole machine)

I setup a drop rule for the offending IP address:

iptables -A INPUT -s xx.xx.x.xxx -j DROP

However the ping of the server is still through the roof. Is there anything more i can do? I still see the flood coming in with tcpdump however that seems to be normal according to random google sources.

share|improve this question
    
Changed sys_ticrate or fps_max? If yes, see supportwiki.steampowered.com/wiki/Optimizing_a_Dedicated_Server (chapter "Server FPS controL"). –  weeheavy Oct 19 '10 at 9:21

2 Answers 2

This sound to me like a DoS attack, which means that you can't do anything except ignoring the attacker which you've already done. You might also want to ask your ISP to block him.

As for tcpdump still seeing those packets, this is normal. They still exist on the network, but the kernel makes sure that a regular application doesn't see them.

share|improve this answer
iptables -L -n -v|grep DROP

are your drop counters actually increasing?

Are they coming from more than one IP? Do you have any rules in INPUT that might be jumping out? I typically use -I to insert the rule at the top rather than -A to append to the bottom of the ruleset.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.