we run a voice / teamspeak server which receives legitmate traffic on port 9987 from many ips. Sometimes we get DDoSed. So people use single Servers and send 1-3 Gbits of UDP Floods to that port. This intereferes with our application.
I would like to log and maybe block IPs that send incoming traffic over a certain threshold of bandwidth or packets per second for example.
Is there any solution using IPTables or other networking tools to block or at least log IPs that for example send more than 30 MBit/s of UDP traffic? We have a 10 GBit Nic so bandwidth is not the issue the application gets overwhelmed by the amount of invailid requests and starts lagging if we don't block it beforehand.