I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friends' IPs (about 50 of them) into a security group so the rest of the traffic is always blocked.

My enemy is spoofing my players' IPs and sending UDP floods. He sends it from 3-4 IPs.

I'm currently capturing IPs in TCPdump and blocking manually.

For example:

  • I capture packets using tcpdump and then I save it in pcap file

  • I analyze that file and I check for length of the packet

  • If incoming packet length is more than 600 then I manually block IP

    0.007450 → UDP 240 27015 → 54491 Len=991

But it takes too long to do this manually.

Is it possible to get those IPs using a shell script or something so I can block that IP?

  • 2
    If the attacker is spoofing your friend's IP, and you block the IP, what happens to your friend? How does your friend keep playing? – schroeder Feb 24 '20 at 9:12
  • Is there any way to get the IPs of DoS? Like getting DoSed from 10-15 Ips. If I can get Ips I can remove them. – Nihas Feb 24 '20 at 18:15
  • @Nihas you have the IP of the attacker. It's just wrong. You want to find out the true source of the traffic from your logs? You cannot. – schroeder Feb 25 '20 at 10:37

You should look at a solution such as OSSEC or Fail2ban. It will do exactly what you want to achieve. However UDP spoofing is difficult to block, because you can freely spoof the IP address.

  • So attacker can spoof IP from anywhere even if IP spoofing is disabled from the ISP side? – Nihas Feb 24 '20 at 7:53
  • 1
    It depends whether the ISP implements this check. – Lucas Kauffman Feb 24 '20 at 8:22
  • Won't fail2ban block the friend, too? – schroeder Feb 24 '20 at 9:11
  • Is there any way to get the IPs of DoS? Like getting DoSed from 10-15 Ips. If I can get Ips I can remove them. – Nihas Feb 24 '20 at 18:13

First you should look into the reason why the attacker has your friend's IP in the first place. Ask your friend to change the IP, and make sure he is not leaking it again. Or ask him to use a VPN when he connects to your game server, and use that VPN for nothing else. In case the attacker has access to a website (e.g. a clan website) that your friend uses regularly, leaking his IP to the attacker. Also you should ask Amazon AWS to help you block the attacks.

  • Is there any way to get the IPs of DoS? Like getting DoSed from 10-15 Ips. If I can get Ips I can remove them. – Nihas Feb 24 '20 at 18:15
  • @Nihas that's not really a solution, as long as the attacker knows the IP of your friend they can always work around your attempts. You should care about why they have the IP of your friend in the first place. Have him get a new IP (e.g. use VPN or contact the ISP) and make sure it's not leaking to the attacker again. – Martin Fürholz Feb 24 '20 at 21:18

The best thing you can do is to save these captures you did and send it to ISP of the attacker, asking to take measures.

You can do nothing at your end to stop the attacker (without making a big DDoS-protection solution).

As long as the ISP allows the attacker to spoof his source addresses, the attack can continue. The thing you should check before sending the captures is: is it a direct attack or reflected. In case of the reflected attack the ISP is a victim itself (however anyway that could mean there is a malprotected service that should be reconfigured on the ISP side). Direct attacks are consist of packets, directed to your network (like TCP SYN or just UDP flood). Reflected attacks are seen as unexpected replies (like big DNS responses and no requests).

The more analysis you do on your side, the more serious ISP representative will take it - and the faster your issue will be solved.

  • 2
    How does one find the ISP of the attacker when source IPs are spoofed? – schroeder Feb 24 '20 at 9:10
  • It depends. If you're an end customer just to go to your service provider and tell him the whole story. Your ISP is able to trace the attack (while ongoing) towards his peers. Then ISP will contact the peer, the attack goes from and the situation repeat until they find the attacker's ISP. It's also worth to check, if spoofed IPs are originated all from the same ISP - then it would be wise to check with this ISP first. – Iron Feb 25 '20 at 10:30
  • So ... you don't send the captures to the ISP of the attacker, you send it to your ISP. Which in this case is AWS, who connected to the Internet backbone. They are not going to take the time to do all the work you described ... This is not the way to respond. – schroeder Feb 25 '20 at 10:36

In general when you are spoofed with a legitimate IP Address, in your case your friend, what you can do is an analysis of the IP TTL values and try to see if your defense system allows you to put ACL, or rules that allows operations on TTLs such as <>= certain value. If this is not working probably you will need to go to rate limiting solutions.

  • Is there any way to get the IPs of DoS? Like getting DoSed from 10-15 Ips. If I can get Ips I can remove them. – Nihas Feb 24 '20 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.