Originally posted by: Pookie Doo
the ONLY feasible way to stop these attacks to any degree seems to be a packet-sniffer to log the attack, and a firewall to block the IP, once it's been logged.
If so... what packet sniffers seem to work best (I currently use Ethereal)... I need to read up on how to set up the filter. Should the filter be set up to log only packets that are UDP and >254 bytes? If so, anyone have an example filter line they could post?
I appreciate the help guys.
i don't run a server, but if i did, knowing my low budget, i would run it behind a bsd machine with a couple of nics running ipfw as the firewall and logging with tcpdump.
a line you could use as a starting point for this udp deal with tcpdump would be something like
tcpdump -s 255 -x udp > tribes.log &
you don't need to specify the contents here, just the size, which is what i've done here.
when your tribes.log file has entries, add the entries as a rule to ipfw. done deal.
if you were slick, you would write a parser to parse the file, which could then append the rule to /etc/rc.firewall (rules for ipfw). then just set this up in crontab to run every few hours or so and you've got a self regulating system that you don't even have to check or update. you want a real answer, there you go...
the unfortunate part of this is that any c/c++ guy who is somewhat versed in network programming can spoof the source ip part of the udp packet by using raw sockets as opposed to a higher level library. this would make all the firewall talk meaningless, wouldn't you say?
best of luck!
as for me, i'm out of this whole thing at this point.
Post edited by ServerKillerGuy at 10/10/2003 2:52:34 AM