0

I host a GameServer and some stupid guy just keeps attacking my Application server with random queries. I have found a solution to block it but he uses different kinds of queries so I have to block the new ones almost daily using iptables. I bought a test VPS to try and change those flood strings and attack my Dedi just to be sure if everything is now safe because I can't wait for him to attack everyday.

Now the thing is, he uses multiple spoofed IPs in the attack. While my test tool can do it, it looks like some Networking issues not letting it happen. Lets say the target IP is target.com and it has to be attacked by attacker.com while test.com will be the IP that will be used for generating the attack from attacker.com to target.com.

Now I do see on the test.com machine using iftop that attacker.com is flooding target.com but no such attack appears entering the target.com machine. The script for the application flood is the same being used by the attacker and on asking the developer of the script, he says you have to directly be connected to the internet without a firewall/nat/ router.

I'm not good in Networking so I'd like to ask how can we achieve it. Aren't the VPS machines already directly connected, if not how can we get such a machine cheaply for testing?

1 Answer 1

2

It would make more sense to start throttling connections to your application in my opinion, if iptables are an option this: http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ provides the required information.

12
  • Well actually I've researched a lot on the issue and I've already come to a perfect iptables solution in my case. But I just need some testing against it for which I need to generate a multiple IP Spoofed attack.
    – Asad Moeen
    Mar 19, 2012 at 12:57
  • @AsadMoeen a scripting startup of multiple cloud instances may well be the way to go in this case, just ensure you have full legal sign off between yourself and your provider for carrying out the test to avoid any backlash.
    – Oneiroi
    Mar 22, 2012 at 15:58
  • So you basically a mean a Network level startup script before everything to do so? How should I do so?
    – Asad Moeen
    Mar 24, 2012 at 7:01
  • 1
    @AsadMoeen yes I could and no I wouldn't attack anything without prior legal sign off from all relevant parties, and I would advise you on the same.
    – Oneiroi
    Jul 9, 2012 at 20:26
  • 1
    And when you own both the "to" and "from" servers, legalization isn't a problem right?
    – Asad Moeen
    Jul 10, 2012 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .