Forum


Notice to all users

We are migrating towards a new forum system located at community.teamspeak.com, as such this forum will become read-only on January 29, 2020

Results 1 to 4 of 4

Thread: DOS udp_flood

  1. #1
    Join Date
    December 2009
    Location
    Germany
    Posts
    19

    DOS udp_flood

    Befor reinstall my Rootserver
    Code:
    2010/08/10 21:11:05 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/10 21:12:03 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/10 21:54:51 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/10 22:16:06 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/10 22:22:01 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/10 22:24:56 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.55.149:57719][UDP][HLen=20, TLen=108]
    >  
    >  .
    >  
    >  .
    >  
    >  .
    >  
    >  2010/08/15 20:28:47 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 20:32:02 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 20:40:28 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 20:41:24 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 20:46:49 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 21:11:36 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 21:32:47 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/15 21:34:08 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:57776][UDP][HLen=20, TLen=108]
    >  
    >  .
    >  
    >  .
    >  
    >  .
    >  
    >  2010/08/22 21:28:18 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/22 21:32:54 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/22 21:46:03 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/22 21:46:17 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/22 21:54:06 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  2010/08/22 22:33:12 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:58303][UDP][HLen=20, TLen=108]
    >  
    >  .
    >  
    >  .
    >  
    >  .
    >  
    >  2010/09/03 19:09:00 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 20:47:52 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 21:41:26 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 21:56:19 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 21:57:09 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 21:57:30 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 21:58:25 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=108]
    >  
    >  2010/09/03 22:15:51 -- [DOS][Block][udp_flood,
    >  timeout=10][83.169.21.216:9987->88.78.46.0:60192][UDP][HLen=20, TLen=44]
    a day after i had make a cleaninstall of my rootserver
    Code:
    2010/09/12 19:34:19 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    2010/09/12 19:34:30 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    2010/09/12 19:48:27 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    2010/09/12 20:02:20 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    2010/09/12 21:38:44 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    2010/09/12 22:07:04 -- [DOS][Block][udp_flood, timeout=10][83.169.21.216:9987->88.78.52.23:49538][UDP][HLen=20, TLen=108]
    Since the server was reinstalled and the attacks only the start of the port are set at the ts-server, I'll assume from the attacks of the ts-server from

  2. #2
    Join Date
    July 2002
    Location
    Germany
    Posts
    2,192
    this sounds like your "udp flood detection" is broken. Note that a TS3 quite usually sends 50+ packets per seconds to each client in a channel (whenever somebody is talking...). Disable or tweak your "udp flood detection" if it is triggering just because of normal activity (which it looks like it is).

  3. #3
    Join Date
    December 2009
    Location
    Germany
    Posts
    19
    http://83.169.21.216/flood.PNG

    This picture show my config for anti-flood control.

    how should I then set it to work normally

    I do not want to disable for guests

  4. #4
    Join Date
    December 2009
    Posts
    237
    The problem is not related to the Teamspeak 3 anti-flood settings but to your servers firewall.
    Your firewall has an automatic attack detection that gives you a false positive due to the high number of UDP packets per second your server is sending through.
    If you know how to configure your servers firewall you will have to modify your settings so that either outbound traffic is ignored by the attack recognition or that the limit is above 50 packets per second.
    If you dont know how to configure your firewall, contact your hoster.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •