<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
<font size="-1"><font face="Verdana">We are getting hit HARD (.eu)<br>
<br>
I dunno what's the tool you are referring to... could you please
mail me some references privately so I can analyze it?<br>
<br>
Basically we are currently dealing on a daily basis with </font></font><font
size="-1"><font face="Verdana">this kind of attacks</font></font><font
size="-1"><font face="Verdana"> since december ...<br>
<br>
We find ourself handling 10k incoming spoofed packets per second
during certain times of the day...<br>
<br>
What are you referring to small flow? 1k/sec? 100packets/sec?<br>
Which kind of rate limiting figures did you all applied?<br>
We are trying to defend our self with very very strict network
filters... but that's damaging also our services that certain
times appear unreachable (even if they are not)<br>
<br>
In our case it looks like it's not just against other
gameservers... but also against random hosts...<br>
Source packets sometimes are from port 80 udp and, if not
blocked, replies would do an udp flood to the poor host if
enough gameservers were involved... (even if no udp service was
running on port 80) :(<br>
<br>
The worst thing is that the damage to us as "reflectors" is very
low as we are used to handle a shitload of packets so it's
difficult to say if there's an attack going on or not :/<br>
<br>
Additionally, as I'm providing services to different GSP brands
in different countries, I found out that attacks are basically
spread on ALL the servers... using all the servers available on
the master list as reflectors and targeting only a little number
of victims... they are not exploiting just a single GSP /
gameserver :|<br>
<br>
<br>
</font></font>Il 18/01/2011 07:51, John ha scritto:
<blockquote cite="mid:4D353885.6060002@nuclearfallout.net"
type="cite">On 1/17/2011 10:44 PM, Geoff Goas wrote:
<br>
<blockquote type="cite">John, you've seen an increase in attacks
on victims or you are seeing your servers being used as
reflection servers?
<br>
<br>
How are you detecting either/or?
<br>
</blockquote>
<br>
Both. As a victim, from traffic dumps made during large (D)DoS
attacks and from received complaints by the IP owners at other
GSPs that have been concurrent with the attacks on our clients. A
a reflector is from a complaint; it's more difficult to detect
those from the side of the server being used as the reflector
because the flow is small.
<br>
<br>
-John
<br>
_______________________________________________
<br>
cod mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<br>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
<br>
</blockquote>
</body>
</html>