2

I'm currently running a game server on port 27015 under debian. According to the output of:

tcpdump -n -i any dst host xx.xxx.xxx.xxx

The server is getting flooded with:

19:34:48.388401 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0 19:34:48.388405 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0 19:34:48.388407 IP xx.xx.x.xxx.52954 > xx.xxx.xxx.xxx.27015: UDP, length 0

And the ping of the game server is hitting 1000+ (only affecting the server running on this port on this ip, not the whole machine)

I setup a drop rule for the offending IP address:

iptables -A INPUT -s xx.xx.x.xxx -j DROP

However the ping of the server is still through the roof. Is there anything more i can do? I still see the flood coming in with tcpdump however that seems to be normal according to random google sources.

2

This sound to me like a DoS attack, which means that you can't do anything except ignoring the attacker which you've already done. You might also want to ask your ISP to block him.

As for tcpdump still seeing those packets, this is normal. They still exist on the network, but the kernel makes sure that a regular application doesn't see them.

1
iptables -L -n -v|grep DROP

are your drop counters actually increasing?

Are they coming from more than one IP? Do you have any rules in INPUT that might be jumping out? I typically use -I to insert the rule at the top rather than -A to append to the bottom of the ruleset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.