Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next:

4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.213252 194.146.132.110 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.213257 217.65.3.29 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.213261 208.167.240.68 -> 176.58.101.xx UDP Source port: 28960 Destination ort: 28915
4.213266 94.141.160.17 -> 176.58.101.xx QUAKE3 Connectionless Server to Clien
4.213270 83.217.192.242 -> 176.58.101.xx UDP Source port: 28960 Destination ort: 28915
4.213275 188.134.31.51 -> 176.58.101.xx UDP Source port: 28967 Destination prt: 28915
4.216109 208.167.xx4.111 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.216125 66.55.149.202 -> 176.58.101.xx UDP Source port: 28960 Destination prt: 28915
4.216133 208.167.xx4.27 -> 176.58.101.xx UDP Source port: 28960 Destination ort
4.216176 85.21.79.xx -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.216183 208.167.xx4.127 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.216190 94.229.34.11 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.216197 91.203.178.84 -> 176.58.101.xx QUAKE3 Connectionless Server to Client

I just figured out that some packets have Quake3 protocol or kind of, that is strange since im not hosting any quake server. My question is, can I use iptables to filter the incoming packets that have that Quake3 conectionless procotol? if so how?

share|improve this question

marked as duplicate by Falcon Momot, mdpc, Jacob, Ward, Lucas Kauffman Jun 26 '13 at 8:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

1 Answer

Generally this is not a DDOS, it's a flood and it cannot be prevented by iptable rules. The logic here is to just fill your uplink with traffic so that the server is not accessible, this can be unfortunately rectified in such cases only by the upstream provider or the datacenter where your server is located at.

share|improve this answer
    
All the time having a upload bandwidth usage of 60 kb/s and then 200 mb/s is not having a ddos attack? Please check out the low time diference between the packets –  Alejandro Garcia Jun 23 '12 at 22:17
    
There is a difference between a DDOS attack and a flood. The DDOS attack tends to create high loads using a lot of requests to do this, this is usually done by doing requests to services accessible on your server. In this particular case you have lots of UDP packets going to an UDP port which doesn't have anything listening on it(as I understood), this is a flood thus as it's main goal is to fill your uplink with garbage traffic thus making your server not accessible due to the lack of free bandwidth rather then creating high loads on it. –  Logic Wreck Jun 25 '12 at 10:34
    
Nope, A game server is listening there. –  Alejandro Garcia Jun 27 '12 at 2:48
    
Then it's a DDOS. One effective way of fixing such stuff is to write a script which when catching like 100(could be lesser) packets from the same IP of the same size will just block this IP in the firewall. Did something similar on different servers against http DDOS attacks. –  Logic Wreck Jun 27 '12 at 9:40
    
Flood attacks are a subset of DDoS anyway. –  Falcon Momot Jun 26 '13 at 1:14
show 1 more comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.