Another Banning mechanism

wurst · **Posted:** 11.30.11

Oki here we are, one Weekend some weeks ago:
NIC down, restart adapter could bring it back up.

Everything normal exept...
Hm...
Wait! Traffic!

Attachment:

status_rrd_graph_img2.png [ 44.63 KiB | Viewed 8504 times ]

A closer look on the traffic and Adresses brought strange facts:
1.) The recieved packet has 14 bytes. Content is "getstatus". No way to filter this with snort, every game client does it (when parsing masterlist).
2.) Depending on how full the server is, the size of the answer packet is bigger.
3.) All Floods come with around 1 Mbits, they generate 15-20 Mbits upstream.
2.) Its all BF2 Servers! Battlefield? I didnt find any clear Info about that, the attacked servers are quake3 v. 1.16 (not urban terror)

oki, what to do now?
Snort is not an option, the Packet content is ok. The Number of Packets isnt.
First, i started to collect those IPs manually from Pfsense-Ntop Packet HTML Output.
Lateron i found a REST Api, built a DB backend which records 60Sec averages (which have bigger then 500 Packets/sec incoming)
Overall P/sec Throughput is stored too.
Last thing is a schedule, it saves new IPs every ***** to Firewall (and a separate table)

Ah. Thats the list it collected the last 3 Days:

Now is peace. :mrgreen:

Unclefragger · **Posted:** 11.30.11

so bf2 script kiddies kill q3 servers? 8o

anyways good job!

wurst · **Posted:** 11.30.11

hm seems they are beeing abused by other skeletor hax kidz

heres btw what i meant with this nerdish description...

natirips · **Posted:** 11.30.11

Honestly, I found the first post much easier to understand than the third one.

wurst · **Posted:** 11.30.11

thanks...

BEH · **Joined:** 03.15.10 **Posts:** 1132 **Location:** Nijmegen

lol, of course.
The 3rd post he made for the 'user' type person, like me - we like to look at pictures.
It almost makes sense to me now.

Anyways cool that it is peacetime again. congratz

wurst · **Posted:** 12.01.11

he, apparat collected new addresses...

Code:

"ip";"timestamp"
"195.22.18.149";"2011-12-01 01:37:01"
"184.154.131.170";"2011-12-01 04:04:01"
"98.87.83.52";"2011-12-01 04:10:01"
"216.185.96.243";"2011-12-01 04:29:01"
"95.160.65.184";"2011-12-01 04:46:01"
"209.247.83.121";"2011-12-01 05:16:01"
"216.252.52.100";"2011-12-01 05:20:01"
"90.230.138.205";"2011-12-01 05:50:01"
"83.226.50.48";"2011-12-01 06:10:01"
"74.68.120.57";"2011-12-01 06:18:01"
"83.183.37.82";"2011-12-01 06:36:01"
"109.163.229.22";"2011-12-01 06:59:01"
"91.211.117.14";"2011-12-01 07:20:01"
"85.17.232.163";"2011-12-01 09:45:01"
"65.31.119.129";"2011-12-01 10:06:01"
"220.233.205.158";"2011-12-01 10:31:01"
"121.73.145.94";"2011-12-01 10:53:01"
"81.103.60.227";"2011-12-01 11:35:01"
"124.180.74.144";"2011-12-01 11:54:01"

 

Crusher · **Posted:** 12.01.11

So the flood continues... just use the BFG9000 to kill them all.

XTJ7 · **Posted:** 12.01.11

Glad you found a sexy solution for that

wurst · **Posted:** 12.01.11

ah i found the solution to kill existing states in pfsense remotely:

from ./diag_dump_states.php

Code:

/* handle AJAX operations */
if($_GET['action']) {
if($_GET['action'] == "remove") {
$srcip = $_GET['srcip'];
$dstip = $_GET['dstip'];
if (is_ipaddr($srcip) and is_ipaddr($dstip)) {
$retval = mwexec("/sbin/pfctl -k '{$srcip}' -k '{$dstip}'");
echo htmlentities("|{$srcip}|{$dstip}|{$retval}|");
} else {
echo "invalid input";
}
exit;
}
}

So im sending this via teh php

Code:

file_get_contents("http://user:******@192.168.x.y/easyrule-getstatusflood.php?action=block&int=wan&src=".$row['ip']);
file_get_contents("http://user:******@192.168.x.y/diag_dump_states.php?action=remove&srcip=".$row['ip']."&dstip=192.168.x.z");
file_get_contents("http://user:******@192.168.x.y/diag_dump_states.php?action=remove&srcip=192.168.x.z&dstip=".$row['ip']);

Another Banning mechanism

Who is online