Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We host Game Servers off of Windows Server 2008 machines, and we just received a report that one of our customers is using their server to do some type of UDP attack. The person being attacked provided us with the IP address, but do to IPv4 restrictions, we have 5 Game Servers running off that IP address.

What would be the best way to figure out which game server is sending these packets? One of our other techs installed an an application a long time ago that showed live network traffic, but it isn't on this machine and I can't find it.

share|improve this question
    
Also, is there anyway to view a history of network traffic for the last X hours? From looking at the bandwidth graph, the outbound spike in traffic has stopped. –  Brett Powell Oct 22 '11 at 1:00
add comment

2 Answers

up vote 4 down vote accepted

Ask the victim to give you the source port of the datagrams he identified as belonging to the attack.

If you run 5 different game servers on that IP, each of them will run on a different port and therefore you will know which one is the culprit by cross-checking the game server "listening port" to the source port on the UDP datagrams the victim received.

Overall, if you're interested about this kind of traffic inspection in the long run, you want to get yourself familiar with Wireshark and especially its scriptable component: Tshark. Used smartly, these tools can provide extreme insight into any kind of network issues.

share|improve this answer
    
The source port of the attack is 8305, but this isn't the listening port for any of the Game Servers. Most servers have the ability to write .dll based plugins, so this is probably what is being used. None of the Server's ports correspond in any way to the source port of the attack though. –  Brett Powell Oct 22 '11 at 1:21
    
if you're committed to get to the end of this, setup a monitoring session for that machine/ip and log for a sizable amount of time. When you have your log, filter by port and confirm the traffic is indeed coming out of you. On a Windows-based server, you could pair up Netmon with Wireshark (or even use just Netmon but i really dislike it and i don't think it's as flexible as the shark) to pair up a process name with the network traffic. –  ItsGC Oct 22 '11 at 1:25
    
Thanks, this is perfect! –  Brett Powell Oct 22 '11 at 2:24
add comment

You can install Microsoft Network Monitor on the servers and start a capture when you suspect the activity is ocurring. Netmon will track the processes involved in the traffic so you'll be able to narrow it down to a specific process.

As for the traffic history, you'll need something like Netflow configured on your switch or router exporting flows to a Netflow collector.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.