DDoS attacks - Getting to the bottom of them.

[loopyman]

Lately we have been seeing a pattern in DDoS attacks directed at our servers. Most of the large data attackers seem to be Enemy Territory game servers. Almost if not all of them seem to resolve to a Wolfenstein Enemy Territory game server.

Is there some kind of exploit that forces Enemy Territory servers to attack servers? Is there some sort of virus or exploited software or addon going around?

If anybody has any comment or an idea please share it. Id like to put a stop to this.

Attached is a screen capture of one of our latest attacks totaling 1Gbps. Pretty minor compared to some of the 5.5Gbps attacks that we have to sustain when you Garrysmod kiddies piss off the Russians.

The thicker the line the bigger the attack. Some of the smaller lines may have been connected clients to a game server.

[loopyman]

Just from a few quick googlin around:

http://answers.yahoo.com/question/index?qid=20100107142751AAf74xg

[MIG]

I had something like that happen but with COD4 servers, the attacker sends a spoofed server info request to those servers from your IP address (very easy to do) those server send back their details that is a lot bigger than the attackers request to your server, i allows them to use must less bandwidth as well as to be untraceable.

So it's pretty much a connection amplification attack.

[loopyman]

I was thinking it may have been something like that... Which really sucks.