Offline
Some links: vC Fwsl
Let's get that crasher banned so he will be sorry for crashing servers.
Do it unless you want to be his next target.
edited 1×, last 19.05.16 04:18:12 pm
Forum
CS2D
Servers Server hosters please note.
Server hosters please note.
19 replies
1 
Some links: vC Fwsl
Let's get that crasher banned so he will be sorry for crashing servers.
Do it unless you want to be his next target.
Drop packets with empty payload. (You can find it in any DDoS Usgn thread)
1
sudo iptables -A INPUT -p udp -m length --length 28 -j DROP
1
sudo iptables -A INPUT -p udp -m multiport --sport 19,111,53,521,135,161,151,162,123,1434,1900,3306 -j DROP
edited 1×, last 18.05.16 04:32:50 pm
Evaldas: said?Somehow I can't trust his rank :3
well probably someone can confirm that this command drops all packets of incoming connections with ports 19,111,53,521,135,161,151,162,123,1434,1900,3306.
1
sudo iptables -A INPUT -p udp -m multiport --sport 19,111,53,521,135,161,151,162,123,1434,1900,3306 -j DROP
After that, check these ports on wiki or anywhere else.
also you probably want to add this too.
1
--dport 36900:37000
Regards.
David (Hotspot Shield Help Desk) has written
David (Hotspot Shield Help Desk)
Mar 22, 09:18
Hello,
I want to help you out on this matter.
We can protect your IP from any HSS user.
If you share the IP that you want protected, we can set that up as a protected server in our system and then no one using our app can touch it.
Please reply to this message and I will set this in motion.
Thanks,
David
Mar 22, 09:18
Hello,
I want to help you out on this matter.
We can protect your IP from any HSS user.
If you share the IP that you want protected, we can set that up as a protected server in our system and then no one using our app can touch it.
Please reply to this message and I will set this in motion.
Thanks,
David
I have my iptables rules setup to block invalid packets and I still find my server gets crashed by SnK. I dont think this method of prevention/mitigation works against the method(s) he is using to attack.
.cap file would be great.
http://f.cirium.me/attacks_05-13-2016/screen1.png
http://f.cirium.me/attacks_05-13-2016/screen2.png
Notes:
1.
1
2
3
4
5
6
2
3
4
5
6
recv join attempt... (181.163.179.86:58624)
[03:14:27] Fighters | SnK clientdata: WIN {28cefe3ac30ab30ab5268978955263db3271680}
[03:14:27] U.S.G.N.: Fighters | SnK (181.163.179.86) joining with U.S.G.N. ID #150145 - verifying...
[03:14:28] U.S.G.N.: 181.163.179.86 is using U.S.G.N. ID #150145
[03:14:28] Fighters | SnK connected
[03:14:28] Fighters | SnK is using IP 181.163.179.86:58624 and U.S.G.N. ID #150145
1
sudo iptables -A INPUT -s 181.163.179.86 -j DROP
As you can see, there's a packet every 0.02s , which corresponds to a framerate of 50 fps (framerate = netrate).
edited 1×, last 18.05.16 07:17:23 pm
Evaldas Yes, that solution will work temporarily for a couple hours until he changes his IP. That's why I suggested just table'ing the entire ASN. edited 2×, last 18.05.16 07:16:38 pm
Okay.
Vegetables
1