Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by the actual queries like get status or get info to make something like "\xff\xff\xff\xff getstatus " but I see other queries if sent to the game-server will cause it to reply with a "disconnect" packet with the same rate as input so if the input rate is high then the high output of "disconnect" might give lag to the server. Hence I want to block all queries except the ones actual clients use which I suppose are in the form "\xff\xff\xff\xff" or .... so,

I tried using this rule :

    -A INPUT -p udp -m udp -m u32 ! --u32 0x1c=0xffffffff -j ACCEPT 

    -A INPUT -p udp -m udp -m recent --set --name Total --rsource 
    -A INPUT -p udp -m udp -m recent --update --seconds 1 --hitcount 20 --name Total --rsource -j DROP

Now where the rule does accept the clients but it only blocks requests in the form "\xff\xff\xff\xff getstatus " ( by which GameServer replies with status ) and not just "getstatus " ( by which GameServer replies with disconnect packet ). So I suppose the accept rule is accepting the simple "string" as well. I actually want it to also block the non-(\xff) queries. So how do I modify the rule?

share|improve this question
add comment

migrated from serverfault.com Jun 29 '12 at 9:51

This question came from our site for professional system and network administrators.

1 Answer

up vote 1 down vote accepted

You might want to develop a UDP proxy. UDP is very easy to be proxied, each packet is a complete data structure, so it's easy to filter it. UDP proxy would be an Linux C application which is receiving packets on port X and resending it to port Y. This could be simple as single loop. In this loop, you can run any kind of check and drop packets by simply not forwarding them. It's that easy because it seems it's not encrypted traffic.

share|improve this answer
    
Yes that's actually what I asked for. How to do it? –  Asad Moeen Jun 29 '12 at 18:06
    
You could use Snort or Surricata and write rules to block this traffic. You can then automatically filter out hackers on IPTABLES. –  Andrew Smith Jun 29 '12 at 22:28
    
They look like professional tools no doubt but I might have problems using them. Can I provide you a short Pcap file of packets I do want to accept? The rest I can rate-limit and close the unused ports. –  Asad Moeen Jul 1 '12 at 6:01
    
Snort is easy to use however I never used this in Inline mode. From the pcap packet you extract a number of bytes and you put it in a snort rule normally. –  Andrew Smith Jul 9 '12 at 10:54
    
As a hex numbers, you can make hex dump and just add a rule for snort in Inline mode. –  Andrew Smith Jul 9 '12 at 16:11
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.