Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently running a game server on port 27015 under debian. According to the output of:

tcpdump -n -i any dst host

The server is getting flooded with:

19:34:48.388401 IP > UDP, length 0 19:34:48.388405 IP > UDP, length 0 19:34:48.388407 IP > UDP, length 0

And the ping of the game server is hitting 1000+ (only affecting the server running on this port on this ip, not the whole machine)

I setup a drop rule for the offending IP address:

iptables -A INPUT -s -j DROP

However the ping of the server is still through the roof. Is there anything more i can do? I still see the flood coming in with tcpdump however that seems to be normal according to random google sources.

share|improve this question
Changed sys_ticrate or fps_max? If yes, see (chapter "Server FPS controL"). – weeheavy Oct 19 '10 at 9:21

This sound to me like a DoS attack, which means that you can't do anything except ignoring the attacker which you've already done. You might also want to ask your ISP to block him.

As for tcpdump still seeing those packets, this is normal. They still exist on the network, but the kernel makes sure that a regular application doesn't see them.

share|improve this answer
iptables -L -n -v|grep DROP

are your drop counters actually increasing?

Are they coming from more than one IP? Do you have any rules in INPUT that might be jumping out? I typically use -I to insert the rule at the top rather than -A to append to the bottom of the ruleset.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.