<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="-1"><font face="Verdana">Additionally please be aware
that the recent module is very limited by default<br>
<br>
IIRC correctly it just track 20packets per source<br>
<br>
/sys/module/xt_recent/parameters/ip_pkt_list_tot<br>
and<br>
/sys/module/xt_recent/parameters/ip_list_tot<br>
<br>
might be two values you want to tweak too ;)<br>
</font></font><br>
Il 07/01/2012 00:10, NewLight Systems ha scritto:
<blockquote cite="mid:4F077F4B.40505@newlightsystems.com"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
You can play with your hitcount. This can be due to HLSW, xfire,
etc<br>
<br>
<br>
El 07/01/12 0:02, Jeff Love escribió:
<blockquote
cite="mid:94d7e2dc77f5538729d84c06c5f23da2.squirrel@atomic.burgh.net"
type="cite">
<pre wrap="">I'm getting a lot of matches on those rules. This is after less than an hour in place.
pkts bytes target prot opt in out source destination
288K 12M udp -- * * 0.0.0.0/0 0.0.0.0/0 length 42
recent: SET name: getstatus_cod side: source
254K 11M DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 STRING
match "getstatus" ALGO name bm TO 65535recent: UPDATE seconds: 1 hit_count: 20 name:
getstatus_cod side: source
Jeff Love
Burgh Gaming
</pre>
<blockquote type="cite">
<pre wrap="">I've with this rules since some months ago and no problem.
The key is that:
/sbin/iptables -A INPUT -p UDP -m length --length 42 -m recent --set
--name getstatus_cod
/sbin/iptables -A INPUT -p UDP -m string --algo bm --string "getstatus"
-m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP
If hitcount isn't overloaded packets are accepted
El 06/01/12 22:39, Jeff Love escribió:
</pre>
<blockquote type="cite">
<pre wrap="">Are we sure that a getstatus packet length is 42, and that there are no legitimate client packet
length 1162-1168?
If so, this seems like a good fix. I just want to be sure I'm not blocking legitimate client
packets.
Jeff Love
Burgh Gaming
</pre>
<blockquote type="cite">
<pre wrap="">You can try this:
/sbin/iptables -A OUTPUT -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A FORWARD -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A INPUT -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A INPUT -p UDP -m length --length 42 -m recent --set
--name getstatus_cod
/sbin/iptables -A INPUT -p UDP -m string --algo bm --string "getstatus"
-m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP
This prevents your servers to be exploitable. If you are the target
there's nothing in your hand to take UDP floods down, only your ISP can
blackhole offending IPS
</pre>
</blockquote>
<pre wrap="">_______________________________________________
cod mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">--
*David Aguilar Valero*
Dpto. Comercial y Soporte técnico
NewLight Systems
*Servidores de juegos, HW, Dedicados*
*crk01@nls.es* <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:c"><mailto:c></a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:crk01@newlightsystems.com">crk01@newlightsystems.com</a> <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:crk01@newlightsystems.com"><mailto:crk01@newlightsystems.com></a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:tecnico@newlightsystems.com">tecnico@newlightsystems.com</a> <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:tecnico@newlightsystems.com"><mailto:tecnico@newlightsystems.com></a>
#NewLight_Systems @ irc-hispano.org
*www.newlightsystems.com* <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.newlightsystems.com/"><http://www.newlightsystems.com/></a>
*www.nls.es* <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://www.nls.es/"><http://www.nls.es/></a>
This email and any files or attachments transmitted with it are intended
solely for the use of the intended recipient. This email is confidential
and may contain legally privileged information. If you are not the
intended recipient you should not read, disseminate, distribute, or copy
this email. If you have received this email in error, please notify the
sender immediately and delete it from your system.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
_______________________________________________
cod mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
cod mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta http-equiv="Content-Style-Type" content="text/css">
<title></title>
<meta name="Generator" content="Cocoa HTML Writer">
<meta name="CocoaVersion" content="949.54">
<style type="text/css">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Times; min-height: 14.0px}
p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; color: #2e3bfb}
p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier}
p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; min-height: 14.0px}
p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; color: #0018ea}
p.p6 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Times}
span.s1 {text-decoration: underline}
</style>
<p class="p1"><br>
</p>
<p class="p2"><b>David Aguilar Valero</b></p>
<p class="p3">Dpto. Comercial y Soporte técnico</p>
<p class="p3">NewLight Systems</p>
<p class="p2"><b>Servidores de juegos, HW, Dedicados</b></p>
<p class="p4"><br>
</p>
<p class="p5"><span class="s1"><a moz-do-not-send="true"
href="mailto:c"><b>crk01@nls.es</b></a></span></p>
<p class="p5"><span class="s1"><a moz-do-not-send="true"
href="mailto:crk01@newlightsystems.com">crk01@newlightsystems.com</a></span></p>
<p class="p5"><span class="s1"><a moz-do-not-send="true"
href="mailto:tecnico@newlightsystems.com">tecnico@newlightsystems.com</a></span></p>
<p class="p3">#NewLight_Systems @ irc-hispano.org</p>
<p class="p5"><span class="s1"><a moz-do-not-send="true"
href="http://www.newlightsystems.com/"><b>www.newlightsystems.com</b></a></span></p>
<p class="p5"><span class="s1"><a moz-do-not-send="true"
href="http://www.nls.es/"><b>www.nls.es</b></a></span></p>
<p class="p6">This email and any files or attachments
transmitted with it are intended solely for the use of the
intended recipient. This email is confidential and may contain
legally privileged information. If you are not the intended
recipient you should not read, disseminate, distribute, or
copy this email. If you have received this email in error,
please notify the sender immediately and delete it from your
system.</p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
</body>
</html>