It's a spoofed ip and random source port
Claudio Beretta [beretta.clau...@gmail.com] > this is a DDOS attack, probably made from spoofed addresses -----Original Message----- From: hlds-boun...@list.valvesoftware.com [mailto:hlds-boun...@list.valvesoftware.com] On Behalf Of Kyle Sanderson Sent: Saturday, September 05, 2009 1:34 PM To: Half-Life dedicated Win32 server mailing list Subject: Re: [hlds] TF2 DDOS AS2_INFO attack If you guys have root access, why are you not using netstat to grab his IP and table him? I've done this in the past and it's worked out pretty well for me. Kyle. On Sat, Sep 5, 2009 at 11:26 AM, Kenny Loggins <kenny.logg...@clanao.com>wrote: > This guys ISP has to know dam well what he's doing. Its not had to see that > packets that leave your network originate from IP's that are not even on > your network. Maybe we need to track down the ISP and go after him.. > > -----Original Message----- > From: hlds-boun...@list.valvesoftware.com > [mailto:hlds-boun...@list.valvesoftware.com] On Behalf Of Claudio Beretta > Sent: Saturday, September 05, 2009 12:57 PM > To: Half-Life dedicated Win32 server mailing list > Subject: Re: [hlds] TF2 DDOS AS2_INFO attack > > Or someone willing to take down a server.. and taking down other > random ones just to avoid giving away his intentions. > When did this attack started on your server? On mine it started at 4PM > CEST (2PM UTC) > > BTW, this guy must be using spoofed addresses, since I'm being hit by > approx 80000 AS2_INFO requests every 5 minutes from unique IP > addresses. > > > On Sat, Sep 5, 2009 at 7:25 PM, Kenny Loggins<kenny.logg...@clanao.com> > wrote: > > Same here he's hitting one of my server also... I'm up for painting the > > wall's red with this guy when I find him... My guess is some new > > inexperienced server admin looking to take down the poplar servers so he > can > > get people into his server... He'll make some good red paint! > > > > > > -----Original Message----- > > From: hlds-boun...@list.valvesoftware.com > > [mailto:hlds-boun...@list.valvesoftware.com] On Behalf Of Garry Ilverz > > Sent: Saturday, September 05, 2009 11:30 AM > > To: Half-Life dedicated Win32 server mailing list > > Subject: Re: [hlds] TF2 DDOS AS2_INFO attack > > > > My server is also under this type of attack.. So Valve hasnt fixed it .. > Or > > it is some new exploit. sv_max_queries_sec_global 1 doesnt help. Server's > > fps is still dropping and its lagging like hell :( > > > > On Sat, Sep 5, 2009 at 7:23 PM, Saul Rennison > > <saul.renni...@gmail.com>wrote: > > > >> sv_max_queries_sec_global 1? > >> > >> Will make your server appear unresponsive to the Server Browser while > > being > >> DDoS'd but saves the lag. > >> > >> Thanks, > >> - Saul. > >> > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds > > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > http://list.valvesoftware.com/mailman/listinfo/hlds > _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds
