Someone is flooding our server with UDP packets. I simply put iptable rule to block that IP. However, when I run iftop command I can see a huge traffic coming to my server. When i looked for iptables to see how much traffic it has blocked; it only shows some MBs of data has been blocked for that specific IP. Shouldn't it show hug traffic has been blocked?
When I analyze packets using tcpdump I don't see that IP in tcpdump logs. When iftop shows so much in-bound traffic from that ip then why tcpdump doesn't have any trace of that ip?
I have blocked the IP using iptable rule: iptables -I INPUT 1 -s XX.XX.XX.XX -j DROP
iftop is showing traffic from x.ip-x-X-XX.net. Could this be the reason as it's not an IP? I tried to put this address in block list using iptables but iptable resolves it as ip address to block it.
1 - Why iftop is showing so much traffic if iptables is blocking it to come inside my server?
2 - Why iptables is not showing any huge blocked traffic if it's trying to block it?
3 - Is there a difference between blocking an IP and a domain address in iptables?
tcpdump does capture the traffic. I was running the command for eth0 while the attack was on eth1.
tcpdump -C 50 -W 3 -p -n -nn -s 0 -i eth1 -w pkts.pcap