3

We host Game Servers off of Windows Server 2008 machines, and we just received a report that one of our customers is using their server to do some type of UDP attack. The person being attacked provided us with the IP address, but do to IPv4 restrictions, we have 5 Game Servers running off that IP address.

What would be the best way to figure out which game server is sending these packets? One of our other techs installed an an application a long time ago that showed live network traffic, but it isn't on this machine and I can't find it.

1
  • Also, is there anyway to view a history of network traffic for the last X hours? From looking at the bandwidth graph, the outbound spike in traffic has stopped. Oct 22, 2011 at 1:00

2 Answers 2

4

Ask the victim to give you the source port of the datagrams he identified as belonging to the attack.

If you run 5 different game servers on that IP, each of them will run on a different port and therefore you will know which one is the culprit by cross-checking the game server "listening port" to the source port on the UDP datagrams the victim received.

Overall, if you're interested about this kind of traffic inspection in the long run, you want to get yourself familiar with Wireshark and especially its scriptable component: Tshark. Used smartly, these tools can provide extreme insight into any kind of network issues.

2
  • The source port of the attack is 8305, but this isn't the listening port for any of the Game Servers. Most servers have the ability to write .dll based plugins, so this is probably what is being used. None of the Server's ports correspond in any way to the source port of the attack though. Oct 22, 2011 at 1:21
  • if you're committed to get to the end of this, setup a monitoring session for that machine/ip and log for a sizable amount of time. When you have your log, filter by port and confirm the traffic is indeed coming out of you. On a Windows-based server, you could pair up Netmon with Wireshark (or even use just Netmon but i really dislike it and i don't think it's as flexible as the shark) to pair up a process name with the network traffic.
    – ItsGC
    Oct 22, 2011 at 1:25
2

You can install Microsoft Network Monitor on the servers and start a capture when you suspect the activity is ocurring. Netmon will track the processes involved in the traffic so you'll be able to narrow it down to a specific process.

As for the traffic history, you'll need something like Netflow configured on your switch or router exporting flows to a Netflow collector.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .