Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The packets are margin of 200,000 ~ 800,000 per second and UDP spoofed(0 bytes/46bytes)

I have a linux deb 6 and windows server 2003 that is taking a hit.

Current idea: - Setup a proxy server up front to filter out the attack. Would HAProxy work? Do I need a BSD box with PF? What do I need to look for to filter? I need the port being hit but there must be a way to filter and block bad packets?

share|improve this question
All coming from the same IP (or set of IPs)? Any distinguishing features of the packets? – Chris S May 10 '12 at 16:01
up vote 2 down vote accepted

As you are stating that you "need the port", I assume that you are offering some kind of public service on the DoS-attacked UDP port. Using HAProxy would not help you as HAProxy

  1. does not support the UDP transport
  2. even if it did, it would not give you the means to differentiate "bad" packets from "good" ones - i.e. would not act as a filter

The available options depend on the characteristics of the "bad" packets.

If you could identify them out based on the header information (IP source/destination address, UDP source/destination port), your best bet would be to ask your ISP to filter packets matching the appropriate criteria.

If you need content inspection or state matching, the ISP probably is not going to be able to help (although it would not hurt to ask) but would need to set up an own packet filtering router able to filter by the defined criteria. pf/BSD as well as netfilter/Linux would likely be able to do the job.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.