0

Im running a debian linux VPS server with a garrysmod server. Today I've recieved a ddos attack and I could log by using tshark the next:

4.213248 91.204.63.5 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.213252 194.146.132.110 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.213257 217.65.3.29 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.213261 208.167.240.68 -> 176.58.101.xx UDP Source port: 28960 Destination ort: 28915
4.213266 94.141.160.17 -> 176.58.101.xx QUAKE3 Connectionless Server to Clien
4.213270 83.217.192.242 -> 176.58.101.xx UDP Source port: 28960 Destination ort: 28915
4.213275 188.134.31.51 -> 176.58.101.xx UDP Source port: 28967 Destination prt: 28915
4.216109 208.167.xx4.111 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.216125 66.55.149.202 -> 176.58.101.xx UDP Source port: 28960 Destination prt: 28915
4.216133 208.167.xx4.27 -> 176.58.101.xx UDP Source port: 28960 Destination ort
4.216176 85.21.79.xx -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.216183 208.167.xx4.127 -> 176.58.101.xx UDP Source port: 28960 Destinationport: 28915
4.216190 94.229.34.11 -> 176.58.101.xx UDP Source port: 28960 Destination pot: 28915
4.216197 91.203.178.84 -> 176.58.101.xx QUAKE3 Connectionless Server to Client

I just figured out that some packets have Quake3 protocol or kind of, that is strange since im not hosting any quake server. My question is, can I use iptables to filter the incoming packets that have that Quake3 conectionless procotol? if so how?

0

1 Answer 1

0

Generally this is not a DDOS, it's a flood and it cannot be prevented by iptable rules. The logic here is to just fill your uplink with traffic so that the server is not accessible, this can be unfortunately rectified in such cases only by the upstream provider or the datacenter where your server is located at.

6
  • All the time having a upload bandwidth usage of 60 kb/s and then 200 mb/s is not having a ddos attack? Please check out the low time diference between the packets Jun 23, 2012 at 22:17
  • There is a difference between a DDOS attack and a flood. The DDOS attack tends to create high loads using a lot of requests to do this, this is usually done by doing requests to services accessible on your server. In this particular case you have lots of UDP packets going to an UDP port which doesn't have anything listening on it(as I understood), this is a flood thus as it's main goal is to fill your uplink with garbage traffic thus making your server not accessible due to the lack of free bandwidth rather then creating high loads on it. Jun 25, 2012 at 10:34
  • Nope, A game server is listening there. Jun 27, 2012 at 2:48
  • Then it's a DDOS. One effective way of fixing such stuff is to write a script which when catching like 100(could be lesser) packets from the same IP of the same size will just block this IP in the firewall. Did something similar on different servers against http DDOS attacks. Jun 27, 2012 at 9:40
  • Flood attacks are a subset of DDoS anyway. Jun 26, 2013 at 1:14

Not the answer you're looking for? Browse other questions tagged .