<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="-1"><font face="Verdana">Depends on how many different
players you get on your server...<br>
<br>
With just that data it's basically impossible to see if
something else was happening :(<br>
<br>
You need full incoming tcpdump capture :(<br>
Something like:<br>
tcpdump -nnvvXS host 91.220.163.3<br>
<br>
I see it hard to "get it fixed" without traffic samples :(<br>
</font></font><br>
Il 01/11/2011 13:39, Håvard Pedersen ha scritto:
<blockquote
cite="mid:CALBKnbRJdFhnh3UaH5M58_WqCqVFS_Do499Whb_KXoX9OJLWbA@mail.gmail.com"
type="cite">
<pre wrap="">Unfortunately, that is all info I have. OTOH, if this IS a new type of
attack pattern, I guess you will have plenty of other sources pretty
soon (I was sternly instructed by my host to not start up cod4 again
until it had been fixed).
My server is automatically restarted nightly... I am guessing that
should be enought to empty the ip cache?
Håvard Pedersen
<a class="moz-txt-link-freetext" href="http://fuzzy76.net/">http://fuzzy76.net/</a>
On Tue, Nov 1, 2011 at 13:30, Marco Padovan <a class="moz-txt-link-rfc2396E" href="mailto:evcz@evcz.tk"><evcz@evcz.tk></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Looks like a standard attack pattern...
we need the incoming traffic too in order to understand what was being
exploited...
I suppose nothing new was happening here and you just hit the patch "limits"
Take a look at the previous list messages... the current patch actually
has a limit:
the "protection" become ineffective once the tracked ips list is
filled... you either need to increase it to an insane number or just
restart the server before it gets filled :)
HINT: incoming src udp port 80 is the most exploited one and I have yet
to find a legit gameplayer packet generated from that port............
Il 01/11/2011 13:18, Håvard Pedersen ha scritto:
</pre>
<blockquote type="cite">
<pre wrap="">The only info my host had stored was this:
tcpdump ouput during 3 minutes period. 7 records.
12:32:48.533303 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
12:33:10.471172 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
12:33:12.665673 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
12:33:26.951329 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
12:33:46.409945 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
12:33:53.707567 IP 91.229.142.201.28970 > 91.220.163.3.80: UDP, length 563,
Håvard Pedersen
<a class="moz-txt-link-freetext" href="http://fuzzy76.net/">http://fuzzy76.net/</a>
On Tue, Nov 1, 2011 at 12:21, Marco Padovan <a class="moz-txt-link-rfc2396E" href="mailto:evcz@evcz.tk"><evcz@evcz.tk></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Please post a tcpdump capture or additional details
Il 01/11/2011 11:47, Håvard Pedersen ha scritto:
Sorry, I should have been clearer. My server is used as a relay, it is
not the target. (Got a call from my host about massive amounts of
outgoing UDP from my COD4 port)
Håvard Pedersen
<a class="moz-txt-link-freetext" href="http://fuzzy76.net/">http://fuzzy76.net/</a>
On Tue, Nov 1, 2011 at 11:45, Morpheus <a class="moz-txt-link-rfc2396E" href="mailto:morpheus@clantoc.org"><morpheus@clantoc.org></a> wrote:
If you're the target of an attack, the patch won't help you; it only
prevents attacks to be relayed.
Le 01/11/2011 11:42, Håvard Pedersen a écrit :
My patched Linux cod4 server experienced a new attack today and had to
be taken offline. :( Probably a new attack?
Håvard Pedersen
<a class="moz-txt-link-freetext" href="http://fuzzy76.net/">http://fuzzy76.net/</a>
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
</body>
</html>