1

Someone is flooding our server with UDP packets. I simply put iptable rule to block that IP. However, when I run iftop command I can see a huge traffic coming to my server. When i looked for iptables to see how much traffic it has blocked; it only shows some MBs of data has been blocked for that specific IP. Shouldn't it show hug traffic has been blocked?

When I analyze packets using tcpdump I don't see that IP in tcpdump logs. When iftop shows so much in-bound traffic from that ip then why tcpdump doesn't have any trace of that ip?

I have blocked the IP using iptable rule: iptables -I INPUT 1 -s XX.XX.XX.XX -j DROP

iftop is showing traffic from x.ip-x-X-XX.net. Could this be the reason as it's not an IP? I tried to put this address in block list using iptables but iptable resolves it as ip address to block it.

Questions:

1 - Why iftop is showing so much traffic if iptables is blocking it to come inside my server?

2 - Why iptables is not showing any huge blocked traffic if it's trying to block it?

3 - Is there a difference between blocking an IP and a domain address in iptables?

Update

tcpdump does capture the traffic. I was running the command for eth0 while the attack was on eth1.

tcpdump -C 50 -W 3 -p -n -nn -s 0 -i eth1 -w pkts.pcap
3
  • What command are you using when you say tcpdump doesn't see it? What interface are you looking at? Details matter here. – Zoredache Jun 15 '15 at 20:10
  • @Zoredache, thanks for your reply. I was Googling meawhile and found error in my tcpdump command. I ran it for eth0 while attack was on eth1. I can see that tcpdump does capture that traffic. How come iptables didn't block it? – Tweety Jun 15 '15 at 20:15
  • As I suspected, I have added an answer. – Zoredache Jun 15 '15 at 20:20
1

Why iftop is showing so much traffic if iptables is blocking it to come inside my server?

Because pcap utilities look capture data from an interface before any netfilter(iptables) rules have been applied.

Your rule blocking the traffic will prevent that traffic from being forwarded, or processed by any software running on the server. Netfilter cannot stop the packets from getting to your system in the first place. For that some kind of filtering would need to happen upstream.

Is there a difference between blocking an IP and a domain address in iptables?

Netfilter(iptables) primarily operates at layer 3 in the network model. All it knows is IP addresses, and ports. The iptables tool, which adds the rules into kernel (netfilter) will attempt to resolve DNS for a rule for you, but that happens when the rule is inserted into the kernel.

7
  • Thanks! tcpdump can capture the traffic. It means nothing is stopping it. Isn't it? – Tweety Jun 15 '15 at 20:20
  • By the way, before this rule blocked this flood and he couldn't do anything. Maybe after some days of work he came back again and his attack worked. Is there a way to block this traffic? Hosting support doesn't know what they are talking about :( – Tweety Jun 15 '15 at 20:21
  • Depends on what you mean by 'stopping'. If someone is flooding you with packets they will still be delivered to your system. An iptables DROP rule prevents your system from doing anything with the packets, once they have arrived. – Zoredache Jun 15 '15 at 20:22
  • I mean, is it possible to block all the traffic that it doesn't enter in my server? For example, not even till tcpdump command? As I said, in past the same rule blocked all the traffic and iptables command (iptables -nvL --line-numbers) showed that it blocked GBs of data. However, now this command is not blocking. – Tweety Jun 15 '15 at 20:52
  • Call your ISP, and have them block it on their equipment. Think it through. Your server cannot decide to block/permit something until it has already arrived. You of course could just turn off your server, then you won't get any packets. – Zoredache Jun 15 '15 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.