SA-MP Forums

Go Back   SA-MP Forums > SA-MP Server > Server Support

Reply
 
Thread Tools Display Modes
Old 14/07/2018, 03:58 AM   #1
mcreed
Huge Clucker
 
Join Date: Nov 2011
Location: La Lima, Honduras.
Posts: 212
Reputation: 2
Default UDP Flood with packages similar to SA-MP

Hi.

I have 3 server's on a VPS a long time ago that had no problems, but in the last few days they have started attacking me by sending UDP packets.
Also these UDP packets are very similar to those of SA-MP so I can not find how to avoid them.
Nor can I block the IP because it comes from several.
The attack sends as 4 UDP packets per second, and after these, changes IP and sends another 4 packets, and so on.
Would you have any idea?
My VPS is from nfo.
Here are the attacker's packages:
Quote:
12:56:37.676903 IP (tos 0x0, ttl 114, id 43000, offset 0, flags [none], proto UDP (17), length 43)
190.164.107.140.38638 > x.x.x.x.9010: UDP, payload 15
0x0000: 4500 002b a7f8 0000 7211 bbc4 bea4 6b8c E..+....r.....k.
0x0010: 4a5b 7079 96ee 2332 0017 3b6e 5341 4d50 J[py..#2..;nSAMP
0x0020: 4a5b 7079 b3cd 7070 3887 6d J[py..pp8.m
12:56:37.676907 IP (tos 0x0, ttl 114, id 43001, offset 0, flags [none], proto UDP (17), length 39)
190.164.107.140.38638 > x.x.x.x.9010: UDP, payload 11
0x0000: 4500 0027 a7f9 0000 7211 bbc7 bea4 6b8c E..'....r.....k.
0x0010: 4a5b 7079 96ee 2332 0013 ee6d 5341 4d50 J[py..#2...mSAMP
0x0020: 4a5b 7079 b3cd 63 J[py..c
12:56:37.676912 IP (tos 0x0, ttl 114, id 43002, offset 0, flags [none], proto UDP (17), length 39)
190.164.107.140.38638 > x.x.x.x.9010: UDP, payload 11
0x0000: 4500 0027 a7fa 0000 7211 bbc6 bea4 6b8c E..'....r.....k.
0x0010: 4a5b 7079 96ee 2332 0013 df6d 5341 4d50 J[py..#2...mSAMP
0x0020: 4a5b 7079 b3cd 72 J[py..r
12:56:37.676916 IP (tos 0x0, ttl 114, id 43003, offset 0, flags [none], proto UDP (17), length 43)
190.164.107.140.38638 > x.x.x.x.9010: UDP, payload 15
0x0000: 4500 002b a7fb 0000 7211 bbc1 bea4 6b8c E..+....r.....k.
0x0010: 4a5b 7079 96ee 2332 0017 53f2 5341 4d50 J[py..#2..S.SAMP
0x0020: 4a5b 7079 b3cd 701d b055 dd J[py..p..U.
12:56:37.676920 IP (tos 0x0, ttl 114, id 43004, offset 0, flags [none], proto UDP (17), length 32)
190.164.107.140.38638 > x.x.x.x.9010: UDP, payload 4
0x0000: 4500 0020 a7fc 0000 7211 bbcb bea4 6b8c E.......r.....k.
0x0010: 4a5b 7079 96ee 2332 000c 33b8 081e 24da J[py..#2..3...$.
12:56:37.677247 IP (tos 0x0, ttl 81, id 47028, offset 0, flags [none], proto UDP (17), length 39)
181.193.148.91.23247 > x.x.x.x.9010: UDP, payload 11
0x0000: 4500 0027 b7b4 0000 5111 ad20 b5c1 945b E..'....Q......[
0x0010: 4a5b 7079 5acf 2332 0013 089a 5341 4d50 J[pyZ.#2....SAMP
0x0020: 4a5b 7079 afd4 69 J[py..i
mcreed is offline   Reply With Quote
Old 16/07/2018, 10:32 PM   #2
Y_Less
Beta Tester
 
Y_Less's Avatar
 
Join Date: Jun 2008
Location: 629 - git.io/Y
Posts: 15,104
Reputation: 3166
Default Re: UDP Flood with packages similar to SA-MP

I'm sorry, 4 packets per second is considered a flood?
Y_Less is offline   Reply With Quote
Old 16/07/2018, 10:37 PM   #3
CodeStyle175
Banned
 
Join Date: Apr 2014
Posts: 481
Reputation: 35
Default Re: UDP Flood with packages similar to SA-MP

what cheap shit are you using for hosting?
CodeStyle175 is offline   Reply With Quote
Old 18/07/2018, 05:54 AM   #4
GTLS
Gangsta
 
GTLS's Avatar
 
Join Date: Aug 2014
Location: India
Posts: 827
Reputation: 91
Default Re: UDP Flood with packages similar to SA-MP

Get a real host with firewall and all.
__________________

I don't help for rep. I help cuz I was helped in the past.


California State Roleplay - X Update Now under beta testing phase. Stay Tuned.
GTLS is offline   Reply With Quote
Old 29/07/2018, 05:48 PM   #5
ColorHost-Kevin
High-roller
 
ColorHost-Kevin's Avatar
 
Join Date: May 2011
Location: Hollywood,MD
Posts: 1,598
Reputation: 138
Default Re: UDP Flood with packages similar to SA-MP

I would get host that specializes in UDP DDOS protection. Most services nowadays offer this.

Also contacting your host to see what they can offer helps as well.
__________________
█| Colorhost Premium Web Hosting And Cheap SAMP Servers in US and NL! 100 Slots For $7.95! With Hosted tab for $25.35!
█| Offering Services to customers since 2009! - Now Supporting Direct Credit Card Payments and BitCoin!
█| Check us out today! https://colorhost.co
ColorHost-Kevin is offline   Reply With Quote
Old 08/08/2018, 09:09 PM   #6
Oriovo
Little Clucker
 
Join Date: Feb 2017
Posts: 1
Reputation: 0
Default Re: UDP Flood with packages similar to SA-MP

Quote:
Originally Posted by Y_Less View Post
I'm sorry, 4 packets per second is considered a flood?
Sorry my bad english


Hi, I'm this user, I just lost my account.

Explaining myself better:
The attack uses different IP's, each IP sends a packet of 31, 32, 39 and 43 in general, after this the IP changes and repeats the process.
Repeat this process a huge number of times in less than 1 second, which causes the server to stop responding.
I could say that for every second it sends more than 200 packages.

The example I put above are only a few packets of many that it sends.


I use an NFO VPS.
Oriovo is offline   Reply With Quote
Old 09/08/2018, 07:39 AM   #7
iLearner
Gangsta
 
iLearner's Avatar
 
Join Date: Apr 2017
Posts: 649
Reputation: 133
Default Re: UDP Flood with packages similar to SA-MP

200 packets per second is a lot?
iLearner is offline   Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[Pedido] FS, anti flood, spawn kill flood, crasher. rannyere PortuguÍs/Portuguese 4 14/01/2017 01:28 AM
Similar Angles MP_Spec Scripting Help 3 22/01/2015 03:56 PM
Similar to SA-MP punner Everything and Nothing 10 20/05/2014 07:33 PM
Similar textdraw like this? Dan. Scripting Help 7 13/07/2012 07:04 PM


All times are GMT. The time now is 08:23 AM.


Powered by vBulletin® Version 3.8.6
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.