0

I frequently get dos attacked on UDP with length 0 from

p885068-ipngn200609sizuokaden.shizuoka.ocn.ne.jp.51422

I have tried resolving this host to an ip 180.33.161.68 and added the address to iptables to drop it,but iptables doesn't seem to drop it.

Any help? so that i can block this host ,also the length shown is UDP, length 0 ,is there any way to drop such 0 length udp packets

Here are the rules

1        0     0 ACCEPT     all  --  *      *       45.117.26.115        0.0.0.0/0           
2     199K   32M ACCEPT     all  --  *      *       106.193.0.0/16       0.0.0.0/0           
3        0     0 DROP       all  --  *      *       202.231.72.67        0.0.0.0/0           
4        0     0 DROP       all  --  *      *       180.33.161.68       0.0.0.0/0           
5        0     0 DROP       all  --  *      *       8.4.0.0/24           0.0.0.0/0           
6        0     0 DROP       all  --  *      *       180.33.0.0/24        0.0.0.0/0           
7        0     0 DROP       all  --  *      *       202.231.0.0/16       0.0.0.0/0 
  • That looks like a PTR record, which one can set to just about anything. Your assumption that the A record for that domain name has any relevance might be off. – anx Jun 30 at 22:01
  • Could you post the full output from your iptables? It's possible you have another rule which is matching before these ones. Plus it would be useful to know your default policy. – Thomas Jul 1 at 17:07
-1

If iptables doesn't work, you need to use directly a blackhole route with "ip" command.

For example :

ip route add blackhole 180.33.161.68/32

The only thing is you can't see if you detect this ip is going to enter or not. (But, you pretty sure that this IP can't communicate anymore)

  • Cool, il try that – raghu Jun 28 at 12:35
0
  1. Use the iptables-save -c command to list the full rule set.
  2. Order of rules is very important. It means the first matched rule wins.
  3. To check packets by packet length you can use rule like this, where statement 0:28 will match packets with length from 0 to 28 bytes inclusively (20 bytes of IPv4 header + 8 bytes of UDP header).
iptables -A INPUT -p udp -m length --length 0:28 -j DROP
  1. The length match checks the total length field in the IPv4 header, not IPv4 packet payload length.
  2. To match by huge list of addresses better use the ipset. It works faster than list of rules.
  3. The tcpdump captures a traffic before processing in the firewall. It means you will see the packets those will be blocked by rules.
  • I already have this rule as 1st rule iptables -A INPUT -p udp -m length --length 0:48-j DROP,stil my system is responding to attack – raghu Jun 28 at 12:35
  • Check the rule counter. Is this rule matched against packets? Check the traffic with tcpdump, paste lines with these evil packets into the question (tcpdump -ni <iface> 'udp and ip host X.X.X.X'). – Anton Danilov Jun 28 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.