[cod] ServerArk: A UDP flood attack analyzer and adaptive blocker for gaming servers

Boyd G. Gafford Ph.D. drboyd at westportresearch.com
Tue Mar 13 11:55:49 EDT 2012


I don't see any packets matching the new rules at all.  All the packets 
are 0 (and bytes 0).

That means one of your rules (probably the one with 40044 dropped 
packets, 1881K dropped bytes) is killing the traffic before it gets to 
the new rules. /Notice how in your listing below the protocol shows 
"all" for an early REJECT rule./

The UDP packets have to get down to the various "getstatus", "getinfo", 
etc rules, and then finally to the rule that limits the player to 70 
packets a second.

None of your UDP packets are getting that far.

Once you adjust your rule stopping all UDP packets, you should start 
seeing packets in the various LIMITXXXX chains, and when people are 
playing you'll start seeing packets in the LIMITPLRS chain.


Also, if you are going to protect more than just a few game servers with 
the rules I sent, you'll need to eventually up the packets in the 
various LIMITXXX chains.  The rules I sent handle 3 servers just fine.  
If you are running 30 servers, you might want to up the 5/sec connection 
limit to maybe something around 20 or 30 per second, and the 10/sec 
"getstatus" and "getinfo" up to something around 50 per second.


Thanks,

/Boyd/


On 03/13/2012 09:50 AM, Mavrick wrote:
> This is the output:
>
> [root at game1 source]# iptables -L -v -n
> Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               
> destination
>   707 47868 ACCEPT     all  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           state RELATED,ESTABLISHED
>     0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            
> 0.0.0.0/0
>     0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            
> 0.0.0.0/0
>     0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           state NEW tcp dpt:22
> 40044 1881K REJECT     all  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           reject-with icmp-host-prohibited
>     0     0 LIMITSTAT  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpts:27960:28980 STRING match "getstatus" ALGO 
> name bm FROM 32 TO 33
>     0     0 LIMITINFO  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpts:27960:28980 STRING match "getinfo" ALGO 
> name bm FROM 32 TO 33
>     0     0 LIMITCHLG  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpts:27960:28980 STRING match "getchallenge" 
> ALGO name bm FROM 32 TO 33
>     0     0 LIMITCONN  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpts:27960:28980 STRING match "connect" ALGO 
> name bm FROM 32 TO 33
>     0     0 LIMITPLRS  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpts:27960:28980
>     0     0 LIMITPLRS  udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           udp dpt:25565
>     0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           tcp dpt:25565
>     0     0 ACCEPT     all  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           state RELATED,ESTABLISHED
>
> Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 REJECT     all  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           reject-with icmp-host-prohibited
>
> Chain OUTPUT (policy ACCEPT 332 packets, 72567 bytes)
>  pkts bytes target     prot opt in     out     source               
> destination
>
> Chain LIMITCHLG (1 references)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           limit: avg 5/sec burst 5
>     0     0 DROP       udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0
>
> Chain LIMITCONN (1 references)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           limit: avg 5/sec burst 5
>     0     0 DROP       udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0
>
> Chain LIMITINFO (1 references)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           limit: avg 10/sec burst 10
>     0     0 DROP       udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0
>
> Chain LIMITPLRS (2 references)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 DROP       udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           limit: above 70/sec burst 70 mode srcip-srcport 
> htable-size 128 htable-max 128
>     0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0
>
> Chain LIMITSTAT (1 references)
>  pkts bytes target     prot opt in     out     source               
> destination
>     0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0           limit: avg 10/sec burst 10
>     0     0 DROP       udp  --  *      *       0.0.0.0/0            
> 0.0.0.0/0
> [root at game1 source]#
>
> Now that I have applied the rules, I am unable to get connections to 
> any of the game servers :( Any ideas?
> _______________________________________________
> cod mailing list
> cod at icculus.org
> http://icculus.org/mailman/listinfo/cod
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://icculus.org/pipermail/cod/attachments/20120313/dddad01f/attachment.htm>


More information about the cod mailing list