up vote 0 down vote favorite
share [g+] share [fb]

How should I prevent from UDP flood attacks? My ISP don't wan't to block those attacks.

So all I can do is block this using IPTABLES, I'm using Debian 5.0.

I heard that if there is not maany IP adresses, then it can be blocked. There are 4~ IP addresses, attacking atm.

What rules should I add to successfully block this flood?

Here is a log from the tcp dump:

22:03:51.933106 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933126 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933132 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933137 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933142 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933655 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933675 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933684 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933693 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933701 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.933709 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934036 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934056 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934065 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934073 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934082 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934089 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934286 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934305 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934314 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934620 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934639 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934648 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934657 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934971 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:51.934988 IP 174.37.49.133.53 > MYHOST.53: 32213+ ANY? indobookies.com. (33)
22:03:54.921517 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921534 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921542 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921549 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921824 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921840 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921852 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.921860 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922085 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922102 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922108 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922113 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922355 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922372 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922378 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922382 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922649 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922666 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922672 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922677 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922935 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922953 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922970 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.922982 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.923173 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
22:03:54.923187 IP 204.93.178.102.53 > MYHOST.53: 47840+ ANY? indobookies.com. (33)
link|improve this question
100% accept rate
1  
It really depends why you want to block them. Are they wasting server resources? Are you trying to protect a downstream link that has less bandwidth than your link to the ISP? Are you trying to prevent replies from wasting your upstream bandwidth? – David Schwartz Oct 31 '11 at 21:39
I'm hosting a game server on my dedicated, so I want to block it because it lag a lot in-game. I mean, there are no lags , when theres no attacks from those IPs but if they come, (like 50/sec) my server is working really slow. – Cyclone Oct 31 '11 at 21:55
Have you analyzed why? Is it because the link is clogged in the down direction? Clogged in the up direction? Is the CPU pegged? If so, is it by interrupts? By the DNS server? The solution is going to depend on exactly what the problem is. – David Schwartz Oct 31 '11 at 21:59
I know someone is attacking my server, because he did told me that and wan't a money to stop attacks. – Cyclone Oct 31 '11 at 22:46
Right, but to solve the problem, you need to figure out how and why the attack is hurting you. For example, if it's saturating your outbound link, the solution will completely different from the solution if it's saturating your inbound link. – David Schwartz Oct 31 '11 at 23:59
show 4 more comments
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.