Atak na serwer w Hetzner

[jdamian 0]

Witam,

Od piątku jeden z moich serwerów jest atakowany z internetu. W sobotę jedno z ip zostało zablokowane przez hetznera a dziś już cała sieć. Serwery mam u nich od ponad 3 lat i nigdy nie miałem takiej sytuacji.

Wysłałem już do nich 3 maile jednak bez odpowiedzi, co również jest dziwne.

 

Czy mieliście już takie sytuacje? Czy mogę coś zrobić by blokować takie ataki? Czy hetzner postępuje w porządku rozwiązując problem odcinając całą sieć na swoim routerze brzegowym?

 

Pozdrawiam

Damian

 

Dear Sir or Madam


We regret to inform you that your server with the IP address mentioned
in the above subject line has been the target of an attack from the
Internet.


As a result this has placed a considerable strain on network resources
and consequently a segment of our network has been very adversely
affected.


Your server has therefore been deactivated as a precautionary measure.


A corresponding traffic protocol is attached for your information.


Guidelines regarding further course of action may be found at
http://wiki.hetzner.de/index.php/Leitfaden_bei_Serversperrung/en.


For queries and enquiries regarding activation, please open a Support
Ticket via your administration interface https://robot.your-server.de/
under menu item Support; Requests.


Yours faithfully


Your Hetzner Support Team


Hetzner Online AG
Technical Support
Tel: 0911 234226-950
Fax: 0911 234226-928
support@hetzner.de
http://www.hetzner.com


Registration Office Ansbach, HRB 3204
Management Board: Dipl. Ing. (FH) Martin Hetzner
Supervisory Board Chairwoman: Diana Rothhan


15:20:15.238853 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.240084 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.241314 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.242544 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.243880 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.82.245.70.33475 > xx.xx.xx.6.20: UDP, length
8192
15:20:15.245111 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.247541 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.249971 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154.36591 > xx.xx.xx.6.33500: UDP,
length 7656
15:20:15.251295 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.254052 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 201.20.37.188.53523 > xx.xx.xx.6.113: UDP, length
8192
15:20:15.258164 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.259396 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.260921 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.262723 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.263954 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 69.175.58.130.39947 > xx.xx.xx.6.33511: UDP,
length 8192
15:20:15.265568 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.267098 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.268396 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.269083 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 201.20.37.188 > xx.xx.xx.6: udp
15:20:15.270313 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.271543 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162.34174 > xx.xx.xx.6.33446: UDP,
length 8192
15:20:15.272773 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.274407 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.275639 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.276869 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162.34174 > xx.xx.xx.6.33446: UDP,
length 8192
15:20:15.285542 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.287677 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.288908 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.290138 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.291369 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.292599 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.294042 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.295273 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.295959 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 94.229.73.154 > xx.xx.xx.6: udp
15:20:15.297352 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162.45093 > xx.xx.xx.6.33451: UDP,
length 8192
15:20:15.301916 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.303486 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.304716 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.305947 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174.56531 > xx.xx.xx.6.33440: UDP,
length 7656
15:20:15.307177 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.313778 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.315007 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.316238 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.317468 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.319928 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.321159 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162.55275 > xx.xx.xx.6.33505: UDP,
length 8192
15:20:15.322495 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.323727 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.331419 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.332650 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.333448 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.334679 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.335909 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84.39753 > xx.xx.xx.6.33456: UDP,
length 7656
15:20:15.337139 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.340782 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.341470 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.342772 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.344002 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.345471 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218.47092 > xx.xx.xx.6.33506: UDP,
length 8192
15:20:15.347931 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.349234 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.350464 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.353208 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218.59540 > xx.xx.xx.6.33485: UDP,
length 7656
15:20:15.357137 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84.43068 > xx.xx.xx.6.33487: UDP,
length 7656
15:20:15.358848 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218.37766 > xx.xx.xx.6.33461: UDP,
length 8192
15:20:15.360245 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.362642 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.364552 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.366785 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 298: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.369365 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.370596 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 184.154.12.162 > xx.xx.xx.6: udp
15:20:15.371826 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.373056 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.374287 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.375041 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.376271 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84.24583 > xx.xx.xx.6.33501: UDP,
length 8192
15:20:15.377501 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.378799 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 50.61.247.84 > xx.xx.xx.6: udp
15:20:15.381782 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.382469 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 834: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.383767 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.385164 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.386395 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.391461 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.392692 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.395122 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174 > xx.xx.xx.6: udp
15:20:15.396711 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 69.175.58.130 > xx.xx.xx.6: udp
15:20:15.398095 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 69.175.58.130 > xx.xx.xx.6: udp
15:20:15.399325 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp
15:20:15.400706 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 209.217.226.174.54062 > xx.xx.xx.6.33497: UDP,
length 8192
15:20:15.402004 00:26:88:75:ed:96 > 00:0c:29:46:d4:be, ethertype IPv4
(0x0800), length 1514: 173.231.1.218 > xx.xx.xx.6: udp

[www.ionic.pl 535]

Dbają o jakość swojej sieci, widzę że to jest kilka powtarzalnych IP napisz abuse-y do ich providera.

p.s. jakiś mega to ten atak nie jest ale hetzner ogólnie uczulony jest na swoją sieć in / out co uważam za słuszne.

Poproś hetznera o pełne logi z tych ataków i wy listuj im IP do wycięcia na brzegu.

Edytowano Grudzień 18, 2011 przez www.ionic.pl (zobacz historię edycji)

[jdamian 0]

Dokładnie o to poprosiłem. Hetzner milczy od piątku.

Skoro wiedzą o tym, że jest to atak to czy nie powinni automatycznie blokować te ip?

 

Jedyne co od nich otrzymałem to 3 podobne maile (z automatu):

 

Direction IN

Internal 78.47.121.198

Threshold Traffic 200 MBit/s

Sum 8,716 GByte/300s (238 MBit/s), 14.707.000 packets/300s (49.023 packets/s), 1.463 flows/300s (4 flows/s)

External 91.195.124.8, 1,435 GByte/300s (39 MBit/s), 1.027.000 packets/300s (3.423 packets/s), 1.027 flows/300s (3 flows/s)

External 91.211.104.131, 0,450 GByte/300s (12 MBit/s), 534.000 packets/300s (1.780 packets/s), 12 flows/300s (0 flows/s)

External 91.82.84.212, 0,323 GByte/300s (8 MBit/s), 440.000 packets/300s (1.466 packets/s), 8 flows/300s (0 flows/s)

External 213.128.83.101, 0,280 GByte/300s (7 MBit/s), 254.000 packets/300s (846 packets/s), 4 flows/300s (0 flows/s)

External 213.128.83.122, 0,241 GByte/300s (6 MBit/s), 215.000 packets/300s (716 packets/s), 4 flows/300s (0 flows/s)

External 94.199.183.212, 0,230 GByte/300s (6 MBit/s), 215.000 packets/300s (716 packets/s), 4 flows/300s (0 flows/s)

External 193.138.125.86, 0,227 GByte/300s (6 MBit/s), 233.000 packets/300s (776 packets/s), 4 flows/300s (0 flows/s)

External 85.234.148.9, 0,225 GByte/300s (6 MBit/s), 251.000 packets/300s (836 packets/s), 4 flows/300s (0 flows/s)

External 80.249.166.32, 0,204 GByte/300s (5 MBit/s), 242.000 packets/300s (806 packets/s), 4 flows/300s (0 flows/s)

External 85.114.140.37, 0,203 GByte/300s (5 MBit/s), 245.000 packets/300s (816 packets/s), 4 flows/300s (0 flows/s)

External 93.126.64.206, 0,203 GByte/300s (5 MBit/s), 229.000 packets/300s (763 packets/s), 4 flows/300s (0 flows/s)

External 80.249.166.41, 0,203 GByte/300s (5 MBit/s), 244.000 packets/300s (813 packets/s), 4 flows/300s (0 flows/s)

External 78.143.57.36, 0,202 GByte/300s (5 MBit/s), 227.000 packets/300s (756 packets/s), 4 flows/300s (0 flows/s)

External 194.152.34.36, 0,200 GByte/300s (5 MBit/s), 226.000 packets/300s (753 packets/s), 4 flows/300s (0 flows/s)

External 200.43.192.125, 0,195 GByte/300s (5 MBit/s), 238.000 packets/300s (793 packets/s), 4 flows/300s (0 flows/s)

External 213.128.83.125, 0,192 GByte/300s (5 MBit/s), 209.000 packets/300s (696 packets/s), 4 flows/300s (0 flows/s)

External 217.113.113.117, 0,186 GByte/300s (5 MBit/s), 265.000 packets/300s (883 packets/s), 4 flows/300s (0 flows/s)

External 193.104.7.250, 0,170 GByte/300s (4 MBit/s), 243.000 packets/300s (810 packets/s), 4 flows/300s (0 flows/s)

External 93.157.232.64, 0,168 GByte/300s (4 MBit/s), 238.000 packets/300s (793 packets/s), 4 flows/300s (0 flows/s)

External 65.175.84.88, 0,168 GByte/300s (4 MBit/s), 242.000 packets/300s (806 packets/s), 4 flows/300s (0 flows/s)

External 217.198.1.76, 0,142 GByte/300s (3 MBit/s), 191.000 packets/300s (636 packets/s), 8 flows/300s (0 flows/s)

External 77.43.135.67, 0,138 GByte/300s (3 MBit/s), 266.000 packets/300s (886 packets/s), 4 flows/300s (0 flows/s)

External 62.133.194.28, 0,137 GByte/300s (3 MBit/s), 276.000 packets/300s (920 packets/s), 4 flows/300s (0 flows/s)

External 194.28.210.51, 0,132 GByte/300s (3 MBit/s), 229.000 packets/300s (763 packets/s), 4 flows/300s (0 flows/s)

External 194.106.197.48, 0,131 GByte/300s (3 MBit/s), 229.000 packets/300s (763 packets/s), 4 flows/300s (0 flows/s)

External 92.60.73.25, 0,129 GByte/300s (3 MBit/s), 216.000 packets/300s (720 packets/s), 4 flows/300s (0 flows/s)

External 62.122.176.77, 0,127 GByte/300s (3 MBit/s), 161.000 packets/300s (536 packets/s), 4 flows/300s (0 flows/s)

External 62.140.250.90, 0,126 GByte/300s (3 MBit/s), 226.000 packets/300s (753 packets/s), 4 flows/300s (0 flows/s)

External 8.6.9.127, 0,119 GByte/300s (3 MBit/s), 211.000 packets/300s (703 packets/s), 4 flows/300s (0 flows/s)

External 8.6.15.95, 0,116 GByte/300s (3 MBit/s), 163.000 packets/300s (543 packets/s), 4 flows/300s (0 flows/s)

External 84.22.159.217, 0,113 GByte/300s (3 MBit/s), 215.000 packets/300s (716 packets/s), 4 flows/300s (0 flows/s)

External 8.6.76.94, 0,107 GByte/300s (2 MBit/s), 170.000 packets/300s (566 packets/s), 4 flows/300s (0 flows/s)

External 8.6.9.103, 0,106 GByte/300s (2 MBit/s), 200.000 packets/300s (666 packets/s), 4 flows/300s (0 flows/s)

External 217.76.183.78, 0,103 GByte/300s (2 MBit/s), 220.000 packets/300s (733 packets/s), 4 flows/300s (0 flows/s)

External 109.126.1.46, 0,102 GByte/300s (2 MBit/s), 167.000 packets/300s (556 packets/s), 8 flows/300s (0 flows/s)

External 8.3.6.185, 0,097 GByte/300s (2 MBit/s), 204.000 packets/300s (680 packets/s), 4 flows/300s (0 flows/s)

External 85.21.79.23, 0,095 GByte/300s (2 MBit/s), 176.000 packets/300s (586 packets/s), 4 flows/300s (0 flows/s)

External 193.19.82.16, 0,091 GByte/300s (2 MBit/s), 198.000 packets/300s (660 packets/s), 4 flows/300s (0 flows/s)

External 81.4.234.4, 0,086 GByte/300s (2 MBit/s), 106.000 packets/300s (353 packets/s), 4 flows/300s (0 flows/s)

External 195.122.134.63, 0,086 GByte/300s (2 MBit/s), 202.000 packets/300s (673 packets/s), 4 flows/300s (0 flows/s)

External 212.75.210.46, 0,074 GByte/300s (2 MBit/s), 159.000 packets/300s (530 packets/s), 4 flows/300s (0 flows/s)

External 92.124.196.37, 0,063 GByte/300s (1 MBit/s), 107.000 packets/300s (356 packets/s), 4 flows/300s (0 flows/s)

External 173.231.1.218, 0,059 GByte/300s (1 MBit/s), 42.000 packets/300s (140 packets/s), 42 flows/300s (0 flows/s)

External 213.248.1.143, 0,058 GByte/300s (1 MBit/s), 82.000 packets/300s (273 packets/s), 4 flows/300s (0 flows/s)

External 85.195.105.130, 0,051 GByte/300s (1 MBit/s), 134.000 packets/300s (446 packets/s), 4 flows/300s (0 flows/s)

External 212.200.150.15, 0,047 GByte/300s (1 MBit/s), 67.000 packets/300s (223 packets/s), 4 flows/300s (0 flows/s)

External 90.189.192.155, 0,046 GByte/300s (1 MBit/s), 84.000 packets/300s (280 packets/s), 4 flows/300s (0 flows/s)

External 88.166.12.188, 0,031 GByte/300s (0 MBit/s), 22.000 packets/300s (73 packets/s), 22 flows/300s (0 flows/s)

External 213.251.189.201, 0,025 GByte/300s (0 MBit/s), 18.000 packets/300s (60 packets/s), 18 flows/300s (0 flows/s)

External 80.77.175.103, 0,018 GByte/300s (0 MBit/s), 453.000 packets/300s (1.510 packets/s), 8 flows/300s (0 flows/s)

 

[www.ionic.pl 535]

Ogólnie serwerownie są bardzo dalekie od blokowania czegoś z automatu,

czasem klienci robią różne cuda na sieci a operator ma za zadanie jak najwięcej ruchu do klienta przepchać,

bo nie wie o co chodzi i jaki jest profil ruchu u klienta.

 

Brak chęci współpracy w tej materii po części oznacza, że hetzner nie ma ochoty hostować u siebie serwera który robi in czy out takie

ilości pakietów - czyli czegoś co jest zawsze wyzwaniem dla każdego ISP (jak najniższym [nie mówię o kosztach urządzeń] kosztem przepchać jak największy burst).

Z drugiej strony to olewackie podejście trochę męczy bo przecież Ty nie możesz zadzwonić do osoby któa Cię atakuje i poprosić by przestała, zdropować tego nie zdropujesz, bo niby jak skoro albo zapcha Ci się sieciówka albo CPU dostanie

szału. Ogólnie rzecz biorąc oni Ci tu piszą dlaczego nei masz internetu na serwerze,

bo wątpię że oczekują na jakieś kroki z Twojej strony Zauważ że może by ćw sieci ileś serwerów które robią 50k pakietów i wtedy już będzie miazga na sieci, dlatego to łapią monitoringiem.

Edytowano Grudzień 18, 2011 przez www.ionic.pl (zobacz historię edycji)

[jdamian 0]

Ogólnie serwerownie są bardzo dalekie od blokowania czegoś z automatu,

...oprócz własnych klientów

 

 

no cóż, pora zmienić serwerownię

 

Mógłby mi ktoś doradzić czy taki wpis, mógłby zapobiec atakom podobnym do powyższych?

router: vyatta z drop default

 

 

 

rule 2 {

action accept

destination {

address x.x.x.x/29

}

limit {

burst 1

rate 200/second

}

protocol all

source {

address 0.0.0.0/0

}

}

Edytowano Grudzień 18, 2011 przez jdamian (zobacz historię edycji)

[marcinsvr 0]

To mój pierwszy post na forum, więc dzień dobry wszystkim.

Od razu zaznaczam, że jeszcze raczkuję w temacie sieci ale ponieważ sam posiadam serwer w Hetzner, to temat mnie interesuje. Jeżeli więc zacznę pisać bzdury - z chęcią wysłucham korekty.

 

W tym linku, który Ci Hetzner podał we wiadomości piszą, że: "(...)First of all, please examine the log files of the server. Often you can find information there about how the malicious software has entered the system(...)".

Czy to nie znaczy, że to Twój serwer w jakiś sposób został zainfekowany i generuje podejrzany ruch?

[jdamian 0]

@marcinsvr:

 

to w przypadku kiedy Twój serwer dokonuje ataków. Tutaj mamy do czynienia z ataiem z zewnątrz.

 

 

Dziś rano napisałem kolejnego maila i tym razem w 5 minut sieć została włączona. Jak widać w weekend nie było nikogo kompetentnego:/

Pytanie tylko co dalej... bo sytuacja pewnie się powtórzy.

[marcinsvr 0]

Hmm, w takim wypadku rzeczywiście blokowanie atakowanego serwera wydaje się - łagodnie ujmując - "dziwnym" podejściem. Dbałość o jakość sieci, dbałością i to się chwali, ale to tak jakby zamknąć w areszcie trzeźwego kierowcę bo "a nuż jakiś pijany się znajdzie i w niego wjedzie".

[VIPserv.org 4]

Mogliby zrobić opcjonalne blokady przychodzącego udp (poza ich rekursywnym dns-em) lub limitowanie tempa przychodzące udp (biorąc resztę na swoją sieć i samodzielnie wysyłać abuse complainty). Blok coprawda spowodował by problemy na własnych serwerów dns, ale często nie one są celem ataku (dlatego rate limit jest lepszy). Oni jednak wolą zablokować serwer który jest atakowany, aby osoba atakująca zobaczyła że wygrała i dała spokój ich sieci - <facepalm>

A więc np. jak chcą kogoś zabić lub pobić należy tą osobę prewencyjnie samodzielnie zabić po cichu, bo wtedy jest pewność że nie ucierpią postronne osoby lub infrastruktura...

Edytowano Grudzień 21, 2011 przez VIPserv.org (zobacz historię edycji)