Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Someone keep attacking my server, but unfortunately I've switched my OS to the FreeBSD, as I've earlier used Debian 5.0 Lenny, and none of netstat or tcpdump commands I used on Debian, works on FreeBSD.

So how can I detect attacker IP address so I could block this guy in the firewall?

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3  
Eh? nixdoc.net/man-pages/FreeBSD/netstat.1.html and manpages.info/freebsd/tcpdump.1.html Maybe install with the package manager? –  Jeff Ferland Mar 9 '12 at 16:36
    
Define attack - surely you can find out what service is being abused without netstat/tcpdump ? –  thinice Mar 9 '12 at 16:50
    
@jefferland: I think it would use the ports collection on FreeBSD to install missing applications. –  Bart Silverstrim Mar 9 '12 at 16:52

3 Answers 3

up vote 0 down vote accepted

Attackers also often use spoofed adresses. Probably what you are looking for is sockstat.

There also is the accf Kernel module, which might help you depending on what your applications are.

I'd also recommend using pf. You could build something along the lines of:

table <bruteforce> persist
pass in proto tcp from any to any port ssh flags S/SA keep state \
    (source-track rule, max-src-conn-rate 2/10, overload <bruteforce> flush global)
block drop in quick from <bruteforce> to any
block out quick from any to <bruteforce>

Stateful Tracking will be your friend

share|improve this answer

By definition/design... a DDoS is not coming from a single IP address. DDoS = Distributed Denial of Service. In short... a large bot-net is typically used to attack a single target, being controlled by a single attacker that potentially could be anywhere in the world. Unfortunately, simply blocking the IPs of the attacker's bots will not solve your headaches. In many cases, your "smaller" internet connection simply cannot keep up with the HUGE amount of traffic generated by such an attack. Even dropping the data coming in, your bandwidth was still consumed. In those instances, your headaches go away when the attacker discontinues his attack. Such an attack must be dealt with by your ISP in order to do anything about it.

share|improve this answer

Whilst not the answer you might be looking for, I think what you are trying to do is going to be unmanageable.

If your system is exposed to the internet, it will get attacked. It might be coming from 1.2.3.4 today, but if you block that address, it could be 2.3.4.5 attacking you the following day. You will end up with a massive unmanageable list of IP addresses that are likely to be dynamically assigned anyway.

Instead of blacklisting "bad" IP addresses, why not use a default deny all rule, and whitelist good IP addresses and services that you do actually want to expose to the internet?

share|improve this answer
    
its not possible since I got an game server. –  Cyclone Mar 9 '12 at 17:50
    
That is definitely possible. Use a default deny rule but white-list the ports that your game server uses, you don't have to white-list IP addresses too, you can white-list a service (port) and/or IP addresses. It really would help though if you defined what you mean by attack in your question, are we talking attacking a vulnerability, or attempts to attack potential vulnerabilities, or just some users misbehaving on your game server? –  Bryan Mar 10 '12 at 10:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.