Blocking an SSDP Flood

networking

I've been hosting game-servers since a long time and I keep updating my iptables firewall time and again to block most attacks. One of my game-server port is being flooded with "SSDP" requests and my game-server replies to that with a "disconnect" packet.

Here is how the stream is established coming from Source Port 1900 while the destination is my game-server port,

http://paste.ubuntu.com/8099734/

I have the following iptables configuration that should have been blocking the outgoing "disconnect" packets but it's not working anymore and I have no idea why.

http://paste.ubuntu.com/8099779/

I have temporarily blocked input from UDP source-port 1900 but that is not a good enough solution as my game-server is vulnerable to many other packets so the outgoing "disconnect" packet is something that has to be blocked.

I'm not sure if -m multiport match might be required to block this?

Best Answer

I notice that what you are receiving looks like a reply package, not a request.

So most likely this is an amplification type attack, where they send a small request to SSDP enabled devices on the net, but with your IP spoofed as originator. So when all these devices send their reply, you get 'em.

As an added side effect, your service has no idea what they are talking about and have no choice but to "disconnect" them (which the game server apparently does by sending the text disconnect).

I dont understand why you are targeting your reply to this. Id try going for the incoming package instead, with something like:

iptables -I INPUT -p udp --dport 16000:29000 -m string --to 75 --algo bm --string 'HTTP/1.1 200 OK' -j DROP

Related Solutions

Freebsd – Protecting against UDP flood

The crucial data is this here:

length 1

meaning that someone probably is trying to keep its upstream load low to provoke larger answer packets from your host. The IP source address (182.48.38.227) is probably forged and thus itself an attack victim.

If you are experiencing network congestion due to the UDP load, your only chance of mitigating the impact is to ask your upstream provider to set up a filter rule to stop these UDP packets from being forwarded to your network.

Centos – Fighting Off Network Flooding

Welcome to the wonderful world of (Distributed) Denial of Service or DDoS. Short answer: talk to your ISP and ask them to help you filter out a DoS. Longer answer:

Since it sounds like your network is getting saturated, there is not a whole lot you can do with your network or systems to defend against these attacks -- their aim is to flood you with so much traffic your downstream bandwidth is clogged with junk. To fix this, you'll need to involve your ISP. If you're lucky, the attacks are simple DoS attacks with an identifiable, non-spoofed source address. Your ISP can apply filters to these pretty easily. If you're unlucky, the attacks are using spoofed source addresses and/or distributed amongst a botnet, making it much harder to filter (since there are a wide number of sources). There are still things your ISP can probably do, but they get a bit more complicated. To really defend yourself, you need to look at DDoS mitigation services like those offered by Arbor Networks, VeriSign, etc. Unfortunately, these tend to be quite expensive. Another option might be to look at deploying to a Content Distribution Network like Akamai (at the expensive end) or Cloudflare (at the free end, albeit Cloudflare isn't a full CDN).

As for figuring out what kind of attack it is, you can probably get a clue from the traffic itself. Run tcpdump or equivalent and see what sort of packets you're getting. It could be anything from ICMP (e.g., ping floods) to UDP (e.g., a DNS amplification attack) to TCP (syn flooding). Based on the traffic though, I'd bet on a simple stateless flood attack (i.e., ICMP or UDP). This is actually fortunate since a higher level attack, e.g., a bunch of zombies from a botnet flooding HTTP requests to port 80 or 443, is much harder to deal with.

Best Answer

Related Solutions

Freebsd – Protecting against UDP flood

Centos – Fighting Off Network Flooding

Related Topic