how to drop ip

Discussion in 'Server Operation' started by xlenonz, Aug 20, 2010.

  1. xlenonz

    xlenonz New Member

    how to drop ip immediately

    hi,

    i use many ips for game servers.

    some time i get ddos attack to specific ip adress.

    i can change ip to other server with that command


    arping -U -I eth0 ip address

    but i want, drop that ip.not change to other server.

    i do ifconfig eth0:340 ipadddress netmask 255.255.255.0 drop

    but it will drop like hours.

    thanks.
     
    Last edited: Aug 20, 2010
  2. Mark_NL

    Mark_NL New Member

    take down an ip/(v)interface:
    Code:
    ifdown eth0:3
    bring a ip/(v)interface up:
    Code:
    ifup eth0:3
     
  3. xlenonz

    xlenonz New Member

    hi,

    thanks , but its not working.
    ifdown eth0:340
    usage: ifdown <device name>

    i use centos4.
     
  4. Mark_NL

    Mark_NL New Member

    aw crap .. then use:

    Code:
    ifconfig eth0:340 down
    ow and, 340 vip's? jees ..
     
  5. xlenonz

    xlenonz New Member

    ifconfig eth0:340 down

    its work like i say but it take hours.

    if i get ddos attack, still reach to server.

    i need immediately drop solution.

    i can change ip immediately with that
    arping -U -I eth0 ipadress , other server
    but i cant waste a server only for that :(
     
  6. damir

    damir New Member

    Code:
    route add -host ip.add.re.ss reject
    Code:
    route delete ip.add.re.ss
     
  7. xlenonz

    xlenonz New Member

    route delete ip.add.re.ss
    give that error ; SIOCDELRT: No such process

    so i change add with del and it remove

    route add -host ipadress reject
    route del -host ipadress reject

    but still no change :(

    i look with
    tcpdump -ennqti eth0 \( arp or icmp \) | grep ipadress


    and when i change ip to other server
    Code:
    00:22:56:ce:f1:20 > 00:14:78:51:4c:d8, IPv4, length 74: IP myhomeip > serverip: icmp 40: echo request seq 2160
    00:22:56:ce:f1:20 > 00:14:78:51:4c:d8, IPv4, length 74: IP myhomeip > serverip: icmp 40: echo request seq 2161
    (i ping from home , it tell timeout but still reach server i can see in here)
    00:0e:2e:9f:25:82 > ff:ff:ff:ff:ff:ff, ARP, length 60: arp who-has serverip (ff:ff:ff:ff:ff:ff) tell serverip
    00:0e:2e:9f:25:82 > ff:ff:ff:ff:ff:ff, ARP, length 60: arp who-has serverip (ff:ff:ff:ff:ff:ff) tell serverip
    
    so it tell ff mac adress, i think if i send like that i will drop immediately
     
  8. Mark_NL

    Mark_NL New Member

    if you drop the ip from your interface, you'll have to wait for the arp cache to expire so the packets won't arrive at your server anymore .. arp cache of the switch it's connected to .. you could aslo throw in some connection rate limiting ..

    gamers are annoying people aren't they? ;)
     

Share This Page