<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hey everyone, EscapedTurkey told me about this group, and so I Just
wanted to say a quick hello.<br>
<br>
I'm the guy who got frustrated enough with UDP flood attacks that I
wrote ServerArk to deal with the majority of them. If anyone has
any questions about the program, or any ideas on what they would
like to see in it in the future, by all means let me know.<br>
<br>
Since I've been using it on our JA (Q3 protocol) servers
(<a class="moz-txt-link-freetext" href="http://elitewarriors.net">http://elitewarriors.net</a>) its blocked about 20 high volume attacks
(one at 64Mbps) successfully over the past few months. As long as
the source IP of the UDP flood is not random, it works really well.<br>
<br>
I have a few new ideas on flood detection on random IP attacks I
will ping off your guys over the next few days to see what you
think.<br>
<br>
Also kudos to whoever did the "I don't want to participate in
reflection attacks" iptables rule that matches off of the
'getstatus' UDP packet payload. If everyone who had a Q3 protocol
server (COD, JA, etc) had that rule running reflection attacks would
be a LOT less potent.<br>
<br>
:)<br>
<br>
Thanks,<br>
<br>
<i>Boyd</i><br>
<br>
<div class="moz-signature"><i><font size="-1">__________________________________<br>
Boyd G. Gafford Ph.D.<br>
Manager of Software Development<br>
Westport Research Associates Inc.<br>
7001 Blue Ridge Blvd<br>
Raytown, MO 64133<br>
(816) 358-8990<br>
<a class="moz-txt-link-abbreviated" href="mailto:drboyd@westportresearch.com">drboyd@westportresearch.com</a><br>
</font></i><br>
</div>
</body>
</html>