I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by the actual queries like get status or get info to make something like "\xff\xff\xff\xff getstatus " but I see other queries if sent to the game-server will cause it to reply with a "disconnect" packet with the same rate as input so if the input rate is high then the high output of "disconnect" might give lag to the server. Hence I want to block all queries except the ones actual clients use which I suppose are in the form "\xff\xff\xff\xff" or .... so,

I tried using this rule :

    -A INPUT -p udp -m udp -m u32 ! --u32 0x1c=0xffffffff -j ACCEPT 

    -A INPUT -p udp -m udp -m recent --set --name Total --rsource 
    -A INPUT -p udp -m udp -m recent --update --seconds 1 --hitcount 20 --name Total --rsource -j DROP

Now where the rule does accept the clients but it only blocks requests in the form "\xff\xff\xff\xff getstatus " ( by which GameServer replies with status ) and not just "getstatus " ( by which GameServer replies with disconnect packet ). So I suppose the accept rule is accepting the simple "string" as well. I actually want it to also block the non-(\xff) queries. So how do I modify the rule?


1 Answer 1


You might want to develop a UDP proxy. UDP is very easy to be proxied, each packet is a complete data structure, so it's easy to filter it. UDP proxy would be an Linux C application which is receiving packets on port X and resending it to port Y. This could be simple as single loop. In this loop, you can run any kind of check and drop packets by simply not forwarding them. It's that easy because it seems it's not encrypted traffic.

  • Yes that's actually what I asked for. How to do it?
    – Asad Moeen
    Jun 29, 2012 at 18:06
  • You could use Snort or Surricata and write rules to block this traffic. You can then automatically filter out hackers on IPTABLES. Jun 29, 2012 at 22:28
  • They look like professional tools no doubt but I might have problems using them. Can I provide you a short Pcap file of packets I do want to accept? The rest I can rate-limit and close the unused ports.
    – Asad Moeen
    Jul 1, 2012 at 6:01
  • Snort is easy to use however I never used this in Inline mode. From the pcap packet you extract a number of bytes and you put it in a snort rule normally. Jul 9, 2012 at 10:54
  • As a hex numbers, you can make hex dump and just add a rule for snort in Inline mode. Jul 9, 2012 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .