Windows-Server-2008-R2

ddos 攻擊的可能形式？

  • August 26, 2012

我以前有點問過這個。我已經建立了一個伺服器，為我的網站、dns 和一些遊戲伺服器提供服務。但是，當我檢查我的路由器防火牆日誌時，我會在同一埠上阻止很多傳入的 UDP 數據包。這就是它的樣子，注意埠不是正常的，它沒有打開或使用。

   [INFO] Sat Aug 25 21:25:09 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:25:05 2012 Blocked incoming UDP packet from 186.227.20.17:21401 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:25:05 2012 Blocked incoming UDP packet from 117.203.8.239:14090 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:25:03 2012 Blocked incoming UDP packet from 77.35.1.215:49001 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:24:53 2012 Blocked incoming UDP packet from 90.180.165.121:10011 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:51 2012 Blocked incoming UDP packet from 190.51.167.28:22486 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:24:45 2012 Blocked incoming UDP packet from 159.224.93.23:25946 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:24:44 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:43 2012 Blocked incoming UDP packet from 62.63.214.200:62348 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:40 2012 Blocked incoming UDP packet from 43.244.112.201:45811 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:24:30 2012 Blocked incoming UDP packet from 78.8.169.255:1236 to 84.234.160.79:28018
[INFO] Sat Aug 25 21:24:30 2012 Blocked incoming UDP packet from 91.205.238.31:16672 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:24:29 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:19 2012 Blocked incoming UDP packet from 213.115.74.42:50839 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:13 2012 Blocked incoming UDP packet from 142.68.127.231:40886 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:24:09 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:59 2012 Blocked incoming UDP packet from 87.14.231.178:21360 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:56 2012 Blocked incoming UDP packet from 109.202.150.81:53385 to 84.234.160.79:28018
[INFO] Sat Aug 25 21:23:54 2012 Blocked incoming UDP packet from 83.183.5.227:53786 to 84.234.160.79:28015
[INFO] Sat Aug 25 21:23:53 2012 Blocked incoming UDP packet from 1.228.6.35:29826 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:23:49 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:42 2012 Blocked incoming UDP packet from 109.202.150.81:53371 to 84.234.160.79:28018
[INFO] Sat Aug 25 21:23:41 2012 Blocked incoming UDP packet from 84.90.108.176:49686 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:39 2012 Blocked incoming UDP packet from 186.178.118.94:10063 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:38 2012 Blocked incoming UDP packet from 217.122.204.212:41446 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:36 2012 Blocked incoming UDP packet from 82.33.127.120:18441 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:35 2012 Blocked incoming UDP packet from 81.19.46.234:1183 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:23:33 2012 Blocked incoming UDP packet from 94.69.159.219:63959 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:31 2012 Blocked incoming UDP packet from 83.68.239.193:21808 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:29 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:22 2012 Blocked incoming UDP packet from 109.202.150.81:53370 to 84.234.160.79:28018
[INFO] Sat Aug 25 21:23:21 2012 Blocked incoming UDP packet from 188.27.241.206:55403 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:20 2012 Blocked incoming UDP packet from 189.24.110.248:61712 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:23:13 2012 Blocked incoming UDP packet from 96.50.2.51:15432 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:09 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:23:03 2012 Blocked incoming UDP packet from 37.128.216.210:57785 to 84.234.160.79:28018
[INFO] Sat Aug 25 21:22:58 2012 Blocked incoming UDP packet from 115.37.98.215:24347 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:22:50 2012 Blocked incoming UDP packet from 23.24.147.209:28970 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:22:47 2012 Blocked incoming UDP packet from 86.11.74.217:45682 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:22:46 2012 Blocked incoming UDP packet from 201.249.81.218:42176 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:22:44 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:22:41 2012 Blocked incoming UDP packet from 78.36.218.169:25903 to 84.234.160.79:14953
[INFO] Sat Aug 25 21:22:24 2012 Blocked incoming UDP packet from 176.212.55.166:49001 to 84.234.160.79:61767
[INFO] Sat Aug 25 21:22:21 2012 Blocked incoming TCP packet from 86.100.65.148:58771 to 84.234.160.79:80 as RST:ACK received but there is no active connection
[INFO] Sat Aug 25 21:22:21 2012 Blocked incoming TCP packet from 86.100.65.148:58775 to 84.234.160.79:80 as RST:ACK received but there is no active connection
[INFO] Sat Aug 25 21:22:21 2012 Blocked incoming TCP packet from 86.100.65.148:58776 to 84.234.160.79:80 as RST:ACK received but there is no active connection
[INFO] Sat Aug 25 21:22:21 2012 Blocked incoming TCP packet from 86.100.65.148:58777 to 84.234.160.79:80 as RST:ACK received but there is no active connection
[INFO] Sat Aug 25 21:22:21 2012 Blocked incoming TCP packet from 86.100.65.148:58769 to 84.234.160.79:80 as RST:ACK received but there is no active connection
[INFO] Sat Aug 25 21:22:19 2012 Blocked incoming UDP packet from 201.80.163.51:40668 to 84.234.160.79:61767

請注意，被阻止的常見埠是“61767”，它們開始使用“14953”。而且它不斷出現，日誌不止於此，那我該怎麼辦？服務的開放埠為 1996:Remote desktop, 143:imap, 110:pop3, 25:smtp, 80:http, 443:https, 53:dns。對於遊戲伺服器 ort，我打開了 27000-27900 的範圍，因為我在 Team Fortress 2 中使用 Srcds 伺服器。那我該怎麼辦？從昨天開始就一直出現，為什麼？不知道。

擷取一個 UDP 數據包 @ UDP 61767

00000000  64 31 3A 61 64 32 3A 69  64 32 30 3A 77 97 D9 57   d1:ad2:i d20:w..W 
00000010  FD 9B 37 AD 46 7A 55 32  C8 81 04 A7 36 D9 CE E1   ..7.FzU2 ....6... 
00000020  36 3A 74 61 72 67 65 74  32 30 3A 77 9D 1A BA E9   6:target 20:w.... 
00000030  FF 51 96 85 6E 0A 7C A6  FA 59 C0 69 40 37 36 65   .Q..n.|. .Y.i@76e 
00000040  31 3A 71 39 3A 66 69 6E  64 5F 6E 6F 64 65 31 3A   1:q9:fin d_node1: 
00000050  74 34 3A F2 0A 00 00 31  3A 76 34 3A 55 54 40 76   t4:....1 :v4:UT@v 
00000060  31 3A 79 31 3A 71 65                               1:y1:qe

數據包 2

00000000  64 31 3A 61 64 32 3A 69  64 32 30 3A A4 C6 64 B6   d1:ad2:i d20:..d. 
00000010  60 41 16 2E 34 E3 71 0F  34 4B DE 45 DB 27 BE E4   `A..4.q. 4K.E.'.. 
00000020  39 3A 69 6E 66 6F 5F 68  61 73 68 32 30 3A 77 9D   9:info_h ash20:w. 
00000030  1C A3 5B C9 67 67 97 1B  4D 4D D0 82 98 5F B8 6B   ..[.gg.. MM..._.k 
00000040  B2 7F 36 3A 6E 6F 73 65  65 64 69 31 65 36 3A 73   .6:nose edi1e6:s 
00000050  63 72 61 70 65 69 31 65  34 3A 77 61 6E 74 6C 32   crapei1e 4:wantl2 
00000060  3A 6E 34 32 3A 6E 36 65  65 31 3A 71 39 3A 67 65   :n42:n6e e1:q9:ge 
00000070  74 5F 70 65 65 72 73 31  3A 74 32 3A D8 B2 31 3A   t_peers1 :t2:..1: 
00000080  76 34 3A 5A 6F 00 06 31  3A 79 31 3A 71 65         v4:Zo..1 :y1:qe

UTC + 01:00 上午 02:24 發布：看起來已經結束了，所以停止時很好。

看起來像 BitTorrent 對等查詢流量。

系統可能已註冊到跟踪器 - 是否有可能在機器上執行 BitTorrent 客戶端（或者可能通過 NAT 在其後面執行）？

順便說一句，您的系統被請求的文件的雜湊值在第二個數據包中。我將把它作為練習留給讀者來查找它是什麼文件。

引用自：https://serverfault.com/questions/421185

相關問答

Windows-Server-2008-R2

我是否需要具有 2 個防火牆 DMZ 解決方案的 LAN 中的路由器？

  • October 5, 2018
檢視問答
Windows-Server-2008-R2

對來自特定 IP 地址的所有連接打開 Windows 防火牆

  • February 4, 2021
檢視問答
Windows-Server-2008-R2

Windows 防火牆中允許連接的事件日誌條目

  • August 15, 2019
檢視問答
Windows-Server-2008-R2

阻止 Server 2008 中的所有 RIPE 地址？

  • May 5, 2019
檢視問答
Windows-Server-2008-R2

如何通過 Windows Server VPN 為客戶端連接到 Internet 設置防火牆？

  • February 24, 2019
檢視問答
Vpn

當 VPN 在 DD-WRT 路由器和單獨的 VPN/直接客戶端上停止時，如何阻止網際網路訪問？

  • October 30, 2015
檢視問答