[cod] Query limiting...

[Marco Padovan]

Are you talking about being exploited as reflector or as being target of
the attacks?

If it's the first case one of our mostly exploited machines is being
targeted with something like 10k pps: after filtering _ALL_ the
malicious traffic the machine performance is not affected... we have
seen way higher PPS rates against cod4 in the past...
What PPS rate are you getting? What are the machine specs?
Is it being affected due to the iptables rules or are malicious packets
still leaking and reaching the gameservers ports?

Il 25/10/2011 15:49, NewLight Systems ha scritto:
> Same problems here, the problem is that even with iptables the
> incoming traffic is affecting the machine
>
> El 25/10/11 12:47, Marco Padovan escribió:
>> I can confirm that since the day before yesterday I started to
>> receive alerts from the firewall about cod2 attacks too.
>>
>> In the past (up to 3months ago) enemy territory was another heavily
>> targeted game.
>>
>> Il 25/10/2011 12:43, Luca Farflame Fabbro ha scritto:
>>> Hi Ryan
>>> 	in one of your previous messages you mentioned that this patch can be "ported" also to the other COD servers. Is there any plan to do this?
>>> Now it seems that even if the server are less in number they target the COD2 servers to do the DDOS attacks. Don't have any COD server running so I don't know if also those are used as reflectors.
>>>
>>> Just one simple question  regarding the patch fort the COD4 server.
>>> If you leave the server up'n running for a certain period of time (no restart for 3 weeks let's say) it seems that when the  
>>> sv_queryIgnoreMegs
>>> limit is reached (our servers don't have a lot of players) the server starts to reply to the query with the spoofed IP's. A restart of the server solves the problem.
>>> I know that it will be better to restart the server before that time but would it be a possible solution to flush the stored bad IP's and restart the check on the new incoming packets when the predefined memory is full or just before this happens (% or minimum sv-ignore free memory)? Usually the attackers use the server as a reflector only for a certain amount of time (form 1 hour or less to a maximum of 2 - 3 days) then a lot of time will pass before having the same IP used as destination of the DDOS attack. 
>>>
>>> Regards
>>> 	Luca
>>>
>>> _______________________________________________
>>> cod mailing list
>>> cod at icculus.org
>>> http://icculus.org/mailman/listinfo/cod
>>
>>
>> _______________________________________________
>> cod mailing list
>> cod at icculus.org
>> http://icculus.org/mailman/listinfo/cod
>
> -- 
>
>
> *David Aguilar Valero*
>
> Dpto. Comercial y Soporte técnico
>
> NewLight Systems
>
> *Servidores de juegos, HW, Dedicados*
>
>
> *crk01 at nls.es* <mailto:c>
>
> crk01 at newlightsystems.com <mailto:crk01 at newlightsystems.com>
>
> tecnico at newlightsystems.com <mailto:tecnico at newlightsystems.com>
>
> #NewLight_Systems @ irc-hispano.org
>
> *www.newlightsystems.com* <http://www.newlightsystems.com/>
>
> *www.nls.es* <http://www.nls.es/>
>
> This email and any files or attachments transmitted with it are
> intended solely for the use of the intended recipient. This email is
> confidential and may contain legally privileged information. If you
> are not the intended recipient you should not read, disseminate,
> distribute, or copy this email. If you have received this email in
> error, please notify the sender immediately and delete it from your
> system.
>
>
>
> _______________________________________________
> cod mailing list
> cod at icculus.org
> http://icculus.org/mailman/listinfo/cod
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://icculus.org/pipermail/cod/attachments/20111025/501fe33f/attachment.htm>