<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
It's ok but this isn't working if the UDP floods to your server
because the line is occupied anyway.<br>
<br>
If you are the target, there's nothing you can do in a dedicated
server level.<br>
<br>
This type of attack ( allways if you are the target ) have to be
erradicated in a higher level ( router or carrier ) if you want to
preserve your connection<br>
<br>
El 23/02/12 23:12, Boyd G. Gafford Ph.D. escribió:
<blockquote cite="mid:4F46B9E7.2030501@westportresearch.com"
type="cite">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
Hey everyone, EscapedTurkey told me about this group, and so I
Just wanted to say a quick hello.<br>
<br>
I'm the guy who got frustrated enough with UDP flood attacks that
I wrote ServerArk to deal with the majority of them. If anyone
has any questions about the program, or any ideas on what they
would like to see in it in the future, by all means let me know.<br>
<br>
Since I've been using it on our JA (Q3 protocol) servers (<a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://elitewarriors.net">http://elitewarriors.net</a>)
its blocked about 20 high volume attacks (one at 64Mbps)
successfully over the past few months. As long as the source IP
of the UDP flood is not random, it works really well.<br>
<br>
I have a few new ideas on flood detection on random IP attacks I
will ping off your guys over the next few days to see what you
think.<br>
<br>
Also kudos to whoever did the "I don't want to participate in
reflection attacks" iptables rule that matches off of the
'getstatus' UDP packet payload. If everyone who had a Q3 protocol
server (COD, JA, etc) had that rule running reflection attacks
would be a LOT less potent.<br>
<br>
:)<br>
<br>
Thanks,<br>
<br>
<i>Boyd</i><br>
<br>
<div class="moz-signature"><i><font size="-1">__________________________________<br>
Boyd G. Gafford Ph.D.<br>
Manager of Software Development<br>
Westport Research Associates Inc.<br>
7001 Blue Ridge Blvd<br>
Raytown, MO 64133<br>
(816) 358-8990<br>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:drboyd@westportresearch.com">drboyd@westportresearch.com</a><br>
</font></i><br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
cod mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cod@icculus.org">cod@icculus.org</a>
<a class="moz-txt-link-freetext" href="http://icculus.org/mailman/listinfo/cod">http://icculus.org/mailman/listinfo/cod</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta http-equiv="Content-Style-Type" content="text/css">
<title></title>
<meta name="Generator" content="Cocoa HTML Writer">
<meta name="CocoaVersion" content="949.54">
<style type="text/css">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Times; min-height: 14.0px}
p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; color: #2e3bfb}
p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier}
p.p4 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; min-height: 14.0px}
p.p5 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Courier; color: #0018ea}
p.p6 {margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Times}
span.s1 {text-decoration: underline}
</style>
<p class="p1"><br>
</p>
<p class="p2"><b>David Aguilar Valero</b></p>
<p class="p3">Dpto. Comercial y Soporte técnico</p>
<p class="p3">NewLight Systems</p>
<p class="p2"><b>Servidores de juegos, HW, Dedicados</b></p>
<p class="p4"><br>
</p>
<p class="p5"><span class="s1"><a href="mailto:c"><b>crk01@nls.es</b></a></span></p>
<p class="p5"><span class="s1"><a
href="mailto:crk01@newlightsystems.com">crk01@newlightsystems.com</a></span></p>
<p class="p5"><span class="s1"><a
href="mailto:tecnico@newlightsystems.com">tecnico@newlightsystems.com</a></span></p>
<p class="p3">#NewLight_Systems @ irc-hispano.org</p>
<p class="p5"><span class="s1"><a
href="http://www.newlightsystems.com/"><b>www.newlightsystems.com</b></a></span></p>
<p class="p5"><span class="s1"><a href="http://www.nls.es/"><b>www.nls.es</b></a></span></p>
<p class="p6">This email and any files or attachments transmitted
with it are intended solely for the use of the intended
recipient. This email is confidential and may contain legally
privileged information. If you are not the intended recipient
you should not read, disseminate, distribute, or copy this
email. If you have received this email in error, please notify
the sender immediately and delete it from your system.</p>
</div>
</body>
</html>