Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I could probably make a better title, edit it if you find a better way of phasing my problem. Basically what's happened is that a gameserver host thinks I keep attacking their dedicated server with a DDoS attack; but I do not.

I have a theory that someone is faking their IP so it matches up with mine, and is launching attacks with it. I am worried that this is the case, and am having a hard time convincing the owner of the gameservers that it's not me attacking his servers.

How plausible is this theory?

I also have a connection with only 64kbps upload; this is no near enough to bring the dedicated servers' network down. I would not do such a thing, but if I were to launch a full-scale DDoS attack from my network, what effect would it have (if any) on the target dedicated server?

Edit

The server is question is not mine, but I know the sysadmin of it and can tell you the specs: 16 core (dual CPU) Intel Xeon, 32GB RAM, 8TB HDD space. The sysadmin claims the attack crashed some of the running gameservers on the server.

This question has nothing to do with my other question, which is about testing my software's handling of a DDoS. http://i.stack.imgur.com/2uUol.jpg

share|improve this question

closed as off-topic by DanBig, Sven, Chris S Sep 25 '13 at 13:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – DanBig, Sven, Chris S
If this question can be reworded to fit the rules in the help center, please edit the question.

    
This is pretty much a duplicate of your other question, which is currently circling the drain. –  DanBig Sep 25 '13 at 13:17
    
@DanBig It might have the same topic of DDoS, but is is not a duplicate. Please read the questions again, and tell me where I have mentioned any legal stuff in this one. This is a legit question and currently has absolutely no connection whatsoever to the other question. –  cybermonkey Sep 25 '13 at 13:19
    
From your network? Next to nothing. Even if you had a local network of several hundred machines the result would probably not be noticeable. The first D of DDoS is distributed. You need a lot of machines to hit a server (unless the server is hugely underspecced.). Do you need to DDoS it? Can't you benchmark the server? –  tombull89 Sep 25 '13 at 13:20
    
Oh also if you launched a DDoS from your network your ISP would (or should) shut you down. –  tombull89 Sep 25 '13 at 13:21
2  
1. If those are all single UDP Packets, and crashing the game server without it responding the packets (ie, packet is sent -> server crashes) then it's almost certainly not coming from you. UDP Source (or Remote IP) is trivial to spoof when you do not need 2-way communications. 2. The game server must be pretty awfully designed if a single packet crashes the server. 3. This is not a DDoS (the first "D" is for "Distributed", but this is all coming from the same IP). 4. The law is usually very uninteresting in tiny cases like this, good luck getting anyone to care. –  Chris S Sep 25 '13 at 13:36

1 Answer 1

up vote 1 down vote accepted

That theory is plausible. For some types of DDoS attack (such as SYN floods) it is normal for all the source IPs to be spoofed and for there to be hundreds of thousands or millions of them. Yours could have been included by accident.

Two other plausible theories:

  1. There was a DDoS against your server that was not using spoofed IPs and an infected machine on your network was part of the botnet delivering this DDoS.
  2. Your hosting provider did a simple count of connections to your server and saw your IP address at the top of the list. They concluded that the IPs with the highest number of connections were causing the DDoS. This is probably an erroneous conclusion.

64Kbps upload would probably have little effect on a server but this is dependent on many factors including what type of DoS attack it is and the specs of your server, the applications running on it and its internet connection. It is certainly possible to DoS very powerful servers with dial-up connection if it's the right type of DoS (Slow-loris and the old Ping of Death spring to mind).

Ask your hosting provider for the evidence of the DDoS and how they collected the evidence.


Based on my reading of the related thread in that gaming forum, someone is seeing a lot of UDP traffic from your IP address. UDP is easily spoofable (no response is required) so that's not reliable evidence that it was in fact you.

But it's also clear that you are not a professional sysadmin acting in a professional capacity. As such this question is off-topic.

share|improve this answer
    
The server is question is not mine, but I know the sysadmin of it and can tell you the specs: 16 core (dual CPU) Intel Xeon, 32GB RAM, 8TB HDD space. The sysadmin claims the attack crashed some of the running gameservers on the server. –  cybermonkey Sep 25 '13 at 13:22
    
An attack that crashes the gameservers suggests that it's a DDoS that targets that application. A SYN flood or reflected DNS flood wouldn't do that. Specs and bandwidth are mostly irrelevant in this situation. –  Ladadadada Sep 25 '13 at 13:24
    
The latest attack (from screenshots on their site- one is attached) targets UDP port 50010. See the question that I've just updated with a screenshot of the attack, as given to me by the sysadmin. –  cybermonkey Sep 25 '13 at 13:26
    
Is it possible for attack software to launch an attack as though it's coming from a specific IP? A similar situation happened a couple of weeks ago with someone (with the same victim dedicated server), and he asked that I personally log into his machine and clear it of any attack tools (he foolishly gave out details to others to access the machine). I failed to find any evidence whatsoever of any attack tools, and the servers' bandwidth charts did not show any rise in traffic, of what you would expect for an outgoing attack. –  cybermonkey Sep 25 '13 at 16:58
    
With UDP, yes. Every IP packet has a destination address and port and a source destination and port and all of these can be set to anything you like. For a TCP connection the source must not be spoofed but since you're talking about UDP, anything goes. Someone could be framing you. –  Ladadadada Sep 25 '13 at 20:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.