I have a Debian Linux server which runs a few online game services. I have some competitors in this area and I think one of them is behind the DDoS attacks.

I have full access to the router, so I set a few connection rules in Winbox which can detect and drop the DDoSer IP addresses but I think it's not the best way to prevent an attack.

ddos graph

filter rules

These are some source ip addresses (all from port 53)


Is there any method to prevent or trace a DDoS attack?

  • There are some steps you can take, but in general DDoS attacks are best 'prevented' by having more network capabilities than the DDoS has.
    – Kevin
    Commented Jan 23, 2015 at 14:51
  • 1
    As far as preventing goes, see security.stackexchange.com/questions/241/… security.stackexchange.com/questions/114/… and security.stackexchange.com/questions/73369/… . As far as tracing to the source of the attack goes, hopefully someone else can provide a good answer.
    – Jonathan
    Commented Jan 23, 2015 at 15:26
  • 4
    Sadly, tracing the source of such attack may be difficult since usually bots are used, ie. malware software which contaminated innocent people's machines and are remotely controlled (usually passing through one or several relays to ensure better anonymity of the actual source). Such setup provides both a better anonymity for the attack source and a better bandwidth thanks to the number of unwillingly "volunteers" machines being used. Commented Jan 23, 2015 at 16:06
  • 8
    These are most likely spoofed source IPs anyway.
    – user42178
    Commented Jan 23, 2015 at 17:28

3 Answers 3


No - There is no useful way to trace the source of such an attack. A DDoS will come from hundreds or thousands of machines, probably in multiple countries, and probably all unwittingly victims of an attacker.

But yes - you can prevent such an attack. You have 3 possible solutions:

  • Change IP addresses, so you aren't the target any more.
  • Buy more bandwidth so your pipe is bigger than the total bandwidth aimed at you.
  • Buy the services of a DDoS mitigation provider.
  • 2
    To buy more bandwidth is an endless race I played and we are condamned to loose. A botnet of PC connected in China at 10 Mbit/s will always outperform the biggest connection an enterprise can buy :(. On the other hand, a few intelligent rules (toward the typical deny all) in a router helped me to survive a few DOS.
    – dan
    Commented Aug 18, 2016 at 16:50

You won't be efficient at hunting the IP sources addresses of a moving botnet. They can change quickly, and using udp they don't even need to be the right ones.

I guess that when the source port is 53/udp, the destination port isn't 53/udp. But this is hidden on purpose on your screen capture.

I will also make the assumption that you are not running your own DNS server and are using your provider's one.

I suggest to use more efficient filtering to outperform your attacker in this case. Just enter the following rule on your router:

# just let pass the legitimate 53/udp traffic
permit udp ••my_official_DNS_servers•• port 53 ••my_server_IP_address•• port 53
# deny anything else which is error or attack
deny udp any any port 53
deny udp any port 53 any

And if your router manage it, turn off source routing.


These IP's are probably spoofed as pointed by user42178.

This is probably a "DNS Amplification Attack" which used for DDoS. You can see that the IP's say are DNS servers.

I think a Firewall rule suggested by daniel Azuelos which drops all the UDP packets with Source port 53 ,with the exception of your Official DNS servers (static IP's like will do some help.

Nevertheless, you need to get more bandwidth. This solution only helps you save your Server resources. You can talk to your ISP as well to block the traffic at their Infrastructure and save your bandwidth.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .