[PresidentEvil]

Originally Posted by asherkin Ugh, that's a major engine issue, no work should be done on 'q', it's before even the challenges come into play.

Is there a way to fix this by using a firewall filter?

[asherkin]

Originally Posted by PresidentEvil Is there a way to fix this by using a firewall filter?

I'd need to see some legitimate 'q' packets - the contents don't match other games, but that could just be the attacker failing. If the issue is just that the game miss-handles them, the attacker can just change what he's sending though.

[hlstriker]

Originally Posted by asherkin I'd need to see some legitimate 'q' packets - the contents don't match other games, but that could just be the attacker failing. If the issue is just that the game miss-handles them, the attacker can just change what he's sending though.

Connecting to a CS:GO server gave me the following:

ff ff ff ff 71 63 6f 6e  6e 65 63 74 30 78 30 41
31 30 39 38 31 35 00


ff ff ff ff 71 63 6f 6e  6e 65 63 74 30 78 30 45
41 38 41 42 41 45 00


ff ff ff ff 71 63 6f 6e  6e 65 63 74 30 78 30 45
41 38 41 42 41 45 00

Another connection:

ff ff ff ff 71 63 6f 6e  6e 65 63 74 30 78 30 45
41 38 41 42 41 45 00


ff ff ff ff 71 63 6f 6e  6e 65 63 74 30 78 30 44
31 37 43 37 36 41 00

[PresidentEvil]

http://www.youtube.com/watch?v=U8lHkfuPe4c#t=2

GG


thats my server ip @ 1:00

and he dos's it @4: 30

[hlstriker]

I can't seem to lag my servers with this even with my firewall disabled (my upstream is only 1 Mbps). Maybe it's just a large DDoS attack but because it's using close to legitimate payloads for Source NFO can't make a rule to block it? Do you know how many packets per second you're getting hit with?

[PresidentEvil]

Originally Posted by hlstriker I can't seem to lag my servers with this even with my firewall disabled (my upstream is only 1 Mbps). Maybe it's just a large DDoS attack but because it's using close to legitimate payloads for Source NFO can't make a rule to block it? Do you know how many packets per second you're getting hit with?

idk how to measure it, but there are alot

[Ren3gade]

I'm gonna assume its a kid with 2-3 dedis, spoofing enabled, and NTP Scripts/Amplification installed. Then setup an automated system on it. But he calls it a "DoS Exploit" so he doesnt sound like every other DDoS providing idiot on the internet.

https://forums.alliedmods.net/showthread.php?t=235822

And if the attacks I've been getting lately.. I thank god I am at great host with great DDoS protection/mitigation. If I was still at NFO.. all my servers would be nullrouted every day for the past like 5 days lol.

[Pitbull3]

You think that's something look at this hit we took earlier lol...

[hlstriker]

Originally Posted by Ren3gade And if the attacks I've been getting lately.. I thank god I am at great host with great DDoS protection/mitigation. If I was still at NFO.. all my servers would be nullrouted every day for the past like 5 days lol.

Who are you with now?

Originally Posted by Pitbull3 You think that's something look at this hit we took earlier lol...

Looks like the average attack, depends on the payload size I guess.

[Ren3gade]

Originally Posted by hlstriker Who are you with now? Looks like the average attack, depends on the payload size I guess.

OVH. With their Anti-DDoS PRO + Firewalls as well.

My dedi drops for about 1-5 minutes.. then it mitigates and comes back online with no lag. But the attacker sends attacks like every hour or 2 hours or so. So it's pretty annoying.

I am assuming its just one of the top ranked/populated servers/clans/communities who are trying to get rid of the competition and stay on top. And just keep DDoSing down their competition. Pretty sad they can't do it legitly.