DDoS attacks server vulnerability

[-ffs-Sniper]

Dear MTA community,

the |FFS|Gaming (aka |FFS|Racing) community suffered heavy D®DoS attacks of 200 Mbit/s over 2 months and was barely available. As we moved to a new dedicated server with a 1GBit full duplex link the attacks did not affect the server itself in any way.

I did not record any packetloss and the outgoing bandwidth was not affected aswell. (We are using an external http server)

The only problem I have to face now are slow download speeds in the public 1.3 MTA server during DDoS attacks causing time outs. The attacks are being made on port 22003 with UDP packets (400-1000 bytes per packet) by using the getStatus exploit of gameservers (Quake3, Urban Terror).

Is there any config or method to keep the download speed while being attacked? CSF is already installed. Since he is attacking the 22003 port the MTA server itself must be the problem (no CPU overload, bandwidth fully available, no RAM overload, using HTTP server).

Greetings

-ffs-Sniper

Leader of |FFS|Gaming

Edited May 7, 2012 by Guest

[Jaysds1]

Have you tried restarting the server?

[-ffs-Sniper]

Is that a serious question?

[Jaysds1]

Sorry, but I am trying to help

[Skotinka]

I can guess why ddosed yours server..

maybe can it is needed to make an attempt decrease the amount of slots ?

[Phat Looser]

This would be for the MTA team then:

http://wolffiles.de/index.php?forum-showposts-20 : The problem they solved it was to only answer those requests once per 4 seconds.

Else, it seems that you already checked your connections (vnstat -l), didn't you? It would be interesting how much DDoS affects the map download.

[jhxp]

Not really, that is a fix for potential DDoSing sources, not targets.

[Phat Looser]

As far as I've understood it the trick of that DDoS is that the server answers with a big piece of data on a small request. In that case answering every 4 seconds would decrease the data sent.