Re: [hlds_linux] new kind of ddos / reflect ddos?

2011-03-25 Thread Marco Padovan
Thanks for this clarification. From what I saw there were a lot of servers all around the world receiving those packets... the source (spoofed) was down probably due to the reflection... If it's confirmed 00 isn't a valid challenge I'll filter it out...

Re: [hlds_linux] new kind of ddos / reflect ddos?

2011-03-25 Thread Marco Padovan
Yep, the server was exactly that one :) ___ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux

Re: [hlds_linux] new kind of ddos / reflect ddos?

2011-03-24 Thread Marco Padovan
If you happen to be online right now check your current network flow with: tcpdump -nnvvXS src 64.34.181.243 On Fri, Mar 25, 2011 at 1:31 AM, Marco Padovan evolutioncr...@gmail.com wrote: I'm getting a lot of 20bytes requests with this content: 0x71 (content: 0x7130 3030 3030 3030

Re: [hlds_linux] new kind of ddos / reflect ddos?

2011-03-24 Thread Tony Paloma
This is the first packet sent to servers by connecting clients. The server responds with a challenge number and some other info about the server. However, a client challenge number is supposed to be included with this packet (before the 0's -- this was a semi-recent change), so I'd guess you're

Re: [hlds_linux] new kind of ddos / reflect ddos?

2011-03-24 Thread bottige...@gmail.com
I am getting these packets too. The source address appears to be a srcds server, probably spoofed to cause denial of service. 64.34.181.243:27015 On Thu, Mar 24, 2011 at 8:07 PM, Tony Paloma drunkenf...@hotmail.com wrote: This is the first packet sent to servers by connecting clients. The