I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friends' IPs (about 50 of them) into a security group so the rest of the traffic is always blocked.
My enemy is spoofing my players' IPs and sending UDP floods. He sends it from 3-4 IPs.
I'm currently capturing IPs in TCPdump and blocking manually.
I capture packets using tcpdump and then I save it in pcap file
I analyze that file and I check for length of the packet
If incoming packet length is more than 600 then I manually block IP
0.007450 192.168.168.2 â†’ 220.127.116.11 UDP 240 27015 â†’ 54491 Len=991
But it takes too long to do this manually.
Is it possible to get those IPs using a shell script or something so I can block that IP?