Re: [cobalt-users] OT? kernel log entries

["DutchNet Support" <support@xxxxxxxxxxxxx>]

Hi Gerald,

Thanks,

I will put a deny in IPChains.

In the mean time I have found out that UT is itself a DOS server. epicgames
is working on a update for their IPdriver for *nix to prefent these DOS
attacks, a new driver for Windows is already available at their website..

regards

Erik Venema
DutchNet

----- Original Message -----
From: "Gerald Waugh" <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
To: <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Wednesday, July 31, 2002 3:59 AM
Subject: Re: [cobalt-users] OT? kernel log entries


> On Tuesday 30 July 2002 05:32 pm, DutchNet Support wrote:
> <snip>
> > Jul 30 23:00:06 www kernel: Packet log: input DENY eth0 PROTO=17
> > xx.xx.xxx.xxx:8777 255.255.255.255:9777 L=54 S=0x00 I=0 F=0x4000 T=64
(#39)
> > Jul 30 23:08:15 www kernel: Packet log: input DENY eth0 PROTO=17
> > xx.xx.xxx.xxx:8778 255.255.255.255:9777 L=57 S=0x00 I=0 F=0x4000 T=64
(#39)
> > Jul 30 23:11:33 www kernel: Packet log: input DENY eth0 PROTO=17
> > xx.xx.xxx.xxx:8779 255.255.255.255:9777 L=57 S=0x00 I=0 F=0x4000 T=64
(#39)
> >
> >
> > The "offending" IP address is an Unreal Tournament server, hence the
ports
> > 8777 8778 and 8779.
> > Of course I can put it's IP in the host.deny but in doing so I'm just
> > hiding the problem.
> > The message appears in the kernel log of all our servers and I prefer to
> > correct the problem at the source.
> >
> > So allthough this  is not 100% Cobalt/Raq related I hope somebody can
and
> > will help me with this.
> >
> You can't stop him completely,Unless you get your ISP to do it at his
router
> You could put in an ipchains rule.
>
> --
> Gerald Waugh
> http://frontstreetnetworks.com  SOHO Networks & Web Site Hosting
> Front Street Networks LLC     voice +1 203 785 0699 * fax +1 203 785 1787
> 229 Front Street, Ste. #C, New Haven CT 06513-3203
>
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>
>