New DoS attack

[jeff () JEFFCALVERT COM (Jeff Calvert)]

Hi all,

        I saw a new ugly type of DoS attack this weekend.  An ISP contacted me
about large amounts of UDP traffic coming from one of our
IPs(xxx.xxx.xxx.xxx in the log) targeting one of their
servers(yyy.yyy.yyy.yyy in the log).

18:55:01.117641 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.7716: udp 2
18:55:01.117709 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.9974: udp 2
18:55:01.117801 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.786: udp 2
18:55:01.118093 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.8334: udp 2
18:55:01.118222 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.4376: udp 2
18:55:01.118289 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.3250: udp 2
18:55:01.118357 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.2823: udp 2
18:55:01.118449 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.3929: udp 2
18:55:01.118516 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.9357: udp 2
18:55:01.118584 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.148: udp 2
18:55:01.118651 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.4497: udp 2
18:55:01.118719 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.5000: udp 2
18:55:01.118787 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.4025: udp 2
18:55:01.118854 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.880: udp 2
18:55:01.118922 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.5917: udp 2
18:55:01.118989 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.903: udp 2
18:55:01.119056 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.9044: udp 2
18:55:01.119124 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.6163: udp 2
18:55:01.119192 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.9451: udp 2
18:55:01.119321 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.9390: udp 2
18:55:01.119388 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.997: udp 2
18:55:01.119456 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.2565: udp 2
18:55:01.119523 xxx.xxx.xxx.xxx.7333 > yyy.yyy.yyy.yyy.2796: udp 2

The xxx.xxx.xxx.xxx computer was running an Unreal Tournament server on UDP
port 7333, and someone has a program repeatedly generating connection
requests with a spoofed source address (yyy.yyy.yyy.yyy) and random source
port.  The solution is to deny traffic from the spoofed source, but this is
tedious.  Anyone have a better solution?  The really scary part is with the
amount of game servers out there, and the ease of getting a list of them
(GameSpy); it's not to hard to DoS any machine that accepts UDP packets.
Game servers are usually powerful machines connected to lots of bandwidth,
and perfect for hiding a script-kiddie's tracks.

Jeff Calvert
jeff () jeffcalvert com