<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="-1"><font face="Verdana">To monitor in realtime</font></font>
a specific recent "bucket" you can use this command:<br>
<br>
watch -n 1 -d cat /proc/net/ipt_recent/getstatus_cod<br>
<br>
Il 07/01/2012 00:02, Jeff Love ha scritto:
<blockquote
cite="mid:94d7e2dc77f5538729d84c06c5f23da2.squirrel@atomic.burgh.net"
type="cite">
<pre wrap="">I'm getting a lot of matches on those rules. This is after less than an hour in place.
pkts bytes target prot opt in out source destination
288K 12M udp -- * * 0.0.0.0/0 0.0.0.0/0 length 42
recent: SET name: getstatus_cod side: source
254K 11M DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 STRING
match "getstatus" ALGO name bm TO 65535recent: UPDATE seconds: 1 hit_count: 20 name:
getstatus_cod side: source
Jeff Love
Burgh Gaming
</pre>
<blockquote type="cite">
<pre wrap="">I've with this rules since some months ago and no problem.
The key is that:
/sbin/iptables -A INPUT -p UDP -m length --length 42 -m recent --set
--name getstatus_cod
/sbin/iptables -A INPUT -p UDP -m string --algo bm --string "getstatus"
-m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP
If hitcount isn't overloaded packets are accepted
El 06/01/12 22:39, Jeff Love escribió:
</pre>
<blockquote type="cite">
<pre wrap="">Are we sure that a getstatus packet length is 42, and that there are no legitimate client packet
length 1162-1168?
If so, this seems like a good fix. I just want to be sure I'm not blocking legitimate client
packets.
Jeff Love
Burgh Gaming
</pre>
<blockquote type="cite">
<pre wrap="">You can try this:
/sbin/iptables -A OUTPUT -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A FORWARD -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A INPUT -p UDP -m length --length 1162:1168 -j DROP
/sbin/iptables -A INPUT -p UDP -m length --length 42 -m recent --set
--name getstatus_cod
/sbin/iptables -A INPUT -p UDP -m string --algo bm --string "getstatus"
-m recent --update --seconds 1 --hitcount 20 --name getstatus_cod -j DROP
This prevents your servers to be exploitable. If you are the target
there's nothing in your hand to take UDP floods down, only your ISP can
blackhole offending IPS
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">
--
*David Aguilar Valero*
Dpto. Comercial y Soporte técnico
NewLight Systems
*Servidores de juegos, HW, Dedicados*
*crk01@nls.es* <a class="moz-txt-link-rfc2396E" href="mailto:c"><mailto:c></a>
<a class="moz-txt-link-abbreviated" href="mailto:crk01@newlightsystems.com">crk01@newlightsystems.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:crk01@newlightsystems.com"><mailto:crk01@newlightsystems.com></a>
<a class="moz-txt-link-abbreviated" href="mailto:tecnico@newlightsystems.com">tecnico@newlightsystems.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:tecnico@newlightsystems.com"><mailto:tecnico@newlightsystems.com></a>
#NewLight_Systems @ irc-hispano.org
*www.newlightsystems.com* <a class="moz-txt-link-rfc2396E" href="http://www.newlightsystems.com/"><http://www.newlightsystems.com/></a>
*www.nls.es* <a class="moz-txt-link-rfc2396E" href="http://www.nls.es/"><http://www.nls.es/></a>
This email and any files or attachments transmitted with it are intended
solely for the use of the intended recipient. This email is confidential
and may contain legally privileged information. If you are not the
intended recipient you should not read, disseminate, distribute, or copy
this email. If you have received this email in error, please notify the
sender immediately and delete it from your system.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
</body>
</html>