[devicenull]

Originally Posted by berni And then ? What do you do with random bytes I recommend using 27015:27300 as portrange, the flood blocker works pretty well on my server. I'm using it with ulogd to log the dos attacks to my mysql database, and a php script to generate a report of all attacks including IPs and an automatic lookup with player this IP belongs to

The tools people are using to do this send out predictable packets. You can detect then either block or log these packets