I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.

How do I know what kind of attack it is and from whom is sent?

When he attacks, the RDP freezes and the server doesn't respond.

I've tried different methods of protecting the server with firewall rules and nod32 firewall but nothing worked.

  • 5
    How do you know that it is an attack and not a software or OS bug?
    – schroeder
    Dec 19, 2012 at 19:54
  • I have windows 7 fully updated.
    – Leo
    Dec 19, 2012 at 20:22
  • What security do you have between the game server and the internet? Are you running any intrusion detection? What ports are open? What "game server" are you running, and is it up to date? Merely being fully patched is not evidence that the software is bug free.
    – MCW
    Dec 19, 2012 at 20:51
  • 1.I don't have IDS 2.80,8080,5816,9958 and rdp : 3216 , I'm running a game called conquer which is "open source" and updated by me .
    – Leo
    Dec 19, 2012 at 21:01
  • 5
    My question stands: how do you know that it is an attack and not a problem with the server itself? What is your evidence of an attack besides the server locking up? Have you found/configured the logs yet? Data, data, data ...
    – schroeder
    Dec 19, 2012 at 21:38

1 Answer 1


The short answer is that you need more data. You need firewall and server logs to determine what happened at the time of the event. You can also run a packet capture and analyze the pure traffic for anomalies (use Wireshark for packet captures, Snort for IDS, etc).

  • 2
    Agreed. OP has essentially zero evidence that this is an "attack" of any kind, and not simply an OS bug or networking issue. When you see hoof prints, look for horses, not zebras. Dec 19, 2012 at 22:32
  • I recommend Security Onion for this. Its pretty easy for people who don't have experience setting up these things.
    – user11869
    Dec 19, 2012 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .