Call of Duty series under DDoS Attack

[kloaknet]

Hi there,

We (still) have a COD 2 server running ( we host it ourselfs ). But for some weeks now we noticed it was lagging once a day. First we could not find the reason for this, but now it is clear we are under a DDoS attack.

The server gets a lot of status requests from a lot of different ips, and is answering it by giving the server status, what sucks up the total bandwidth of our internet connection.

After a lot of googling we found the following thread: Query limiting... - Call of Duty server admin list. - ArchiveOrange This shows that not only COD2 is under attack, but a lot of games based on the Quake 3 engine.

Does somebody have any experience to handle this? We dont run a linux server, so iptables is not the answer. Ow, and the IP adresses change, so adding the ip to a firewall is not the best solution.


[sorry, its posted in the wrong section]

[Leg3nd]

Already contacted your server provider? I'll guess they have a solution.

[kloaknet]

as mentioned, we host the server ourselfs, so it not located in a server centre, but at someone his home. And those standard modems don't have a sophisticated firewall.
Read more on: : i3D.net Game Forums /technische-hulp-cod/179891-call-duty-series-under-ddos-attack.html

Because it seems to be worldwide and a lot of servers are attacked, maybe someone already discovered a solution?

[wessie]

It isnt a DDoS attack.. its just a stupid rcon blocker wich is connecting from a list with proxy's (i had the same issue @ cod1/cod2/cod4/cod5 servers from SG)

there was a cmd i think it was g_banips "1" but i am not sure. Basicly what it does it bans a ip after 2x wrong rcon login within 1second (not posible for a human to do this! *if you use the rcon normaly*)

[kloaknet]

thanks for your reply!, we are testing it at the moment

[Leg3nd]

Reply when your issue is solved!

[kloaknet]

It didn't do the trick. At least, it was quite ok for 2 weeks, we did put a lot of ips in the firewall, but atleast for today the attacks are back.

[kloaknet]

After a change of IP, it did go well for a couple of weeks, but again we are back under attack, the problems for all quake engine servers seems to be increasing according multiple fora

[Wormix]

We found this solution:

Getstatus UDP Flood Solution - RankGameHosting.ru » Îáçîð èãðîâûõ õîñòèíãîâ â Ðîññèè è ÑÍÃ
Read more on: : i3D.net Game Forums http://forum.i3d.net/showthread.php?t=179891

It stops the outgoing traffic. Incomming is still 10 kbps, as long as this wont increase it will be fine.

The Call of Duty server uploaded 41 GB in 3 days so I'm glad its over...