July 20, 2008 02:04am pdt

1. donjohnston 4,300
2. from_exp 2,800
3. blu 2,000
3. AdriendeC 2,000
3. ckimball99 2,000
3. Melaleuca 2,000
3. jazarfinn 2,000
8. networkthug 1,500
9. kdearing 1,400
10. omarfarid 1,350
11. dalesit 1,200
11. keith_al... 1,200
13. naftalig... 1,000
13. tfowles 1,000
13. A2the6th 1,000
13. superiz 1,000

1. donjohnston 4,300
2. AdriendeC 4,000
3. BillBach 3,000
4. from_exp 2,800
5. jaredcall 2,424
6. rsivanandan 2,150
7. blu 2,000
7. Jim_Coyne 2,000
7. Melaleuca 2,000
7. jazarfinn 2,000
7. tlrjohn 2,000
7. ckimball99 2,000
7. Faulkenator 2,000
7. skaap2k 2,000
7. rakeshmi... 2,000

01.10.2008 at 02:39AM PST, ID: 23072070

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.0

How to block Gameserver / ip fragment packets

Zones: Transport, Miscellaneous Networking, Network Software Firewalls

Tags: Network, Firewall

I have a webserver and a firewall. Sometimes I can see a large amount of ip fragment packets going to a game server (not allways the same) about 400gb in one night. Can I block this? Can it be a script on a website of one client on that webserver?

Start your free trial to view this solution

Question Stats

Zone: Networking

Question Asked By: WebJoe

Solution Provided By: giltjr

Participating Experts: 2

Solution Grade: B

Translate:

Loading Advertisement...

Microsoft

Internet Protocols
Applications

Development
OS

Hardware
Windows Security

Apple

Operating Systems
Hardware

Programming
Networking

Software

Internet

Search Engines
File Sharing
WebTrends / Stats
Spy / Ad Blockers

Web Browsers
New Net Users
Web Development
Chat / IM

Anti Spam
Web Servers
Anti-Virus
Email Clients

Gamers

Tips
Online / MMORPG
Puzzle
Emulators

Action / Adventure
Role Playing
Consoles
Game Programming

Strategy
Sports
Misc
Computer Games

Digital Living

Hardware
Automotive
New Net Users
New Users

Software
Digital Music
Gaming World
Home Security

Apple
Networking Hardware

Virus & Spyware

Vulnerabilities
IDS
Encryption
Anti-Virus

Operating Systems Security
Software Firewalls
WebApplications
Cell Phones

Operating Systems
Internet
Hardware Firewalls

Hardware

Displays / Monitors
Handhelds / PDAs
Components
Peripherals
Laptops/Notebooks

Servers
Misc
Apple
Embedded Hardware
Networking Hardware

Storage
Desktops
New Users

Software

System Utilities
Industry Specific
Network Management
Photos / Graphics
Page Layout
VMware
Misc
Web Development

OS
CYGWIN
Voice Recognition
Virtualization
Message Queue
Quality Assurance
Security
Firewalls

MultiMedia Applications
Development
Database
Office / Productivity
Business Management
OS/2 Apps
Server Software
Internet / Email

ITPro

OS
Storage
Encryption
Operating Systems Security
Apple Hardware
Laptops & Notebooks
Servers
Networking Hardware
Peripherals
Devices

Displays / Monitors
WebTrends / Stats
Search Engines
Firewalls
Web Computing
WebApplications
IDS
Vulnerabilities
Email Clients
File Sharing

Spy / Ad Blockers
Web Browsers
Web Servers
Networking
Anti-Virus
Consulting
Chat / IM
Anti Spam

Developer

Web Servers
Web Browsers
Game Programming
Dev Tools
Industry Specific
Office / Productivity

Database
CYGWIN
Web Development
Search Engines
File Sharing
WebTrends / Stats

Programming
Content Management
Application Servers
Protocols

Storage

Removable Backup Media
Storage Technology
Servers

Grid
Remote Access
Backup / Restore

Misc
Hard Drives

Miscellaneous
Security
Development
Linux
VMware

MainFrame OS
Unix
Apple
OS / 2
AS / 400

BeOS
Microsoft
VMS / OpenVMS

Database

Oracle
Miscellaneous
MySQL
Software
Sybase
Contact Management
PostgreSQL
Data Manipulation
Clarion
InterSystems Cache

Siebel
MUMPS
OLAP
SQLBase
SAS
GIS & GPS
4GL
Berkeley DB
DB2
Informix

Interbase / Firebird
FoxPro
Reporting
LDAP
Filemaker Pro
MS SQL Server
dBase
MS Access

Security

Misc
Web Browsers
Software Firewalls
Operating Systems Security
File Sharing

Spy / Ad Blockers
Vulnerabilities
WebApplications
IDS
Anti-Virus

Encryption
Anti Spam
Email Clients
VPN
Chat / IM

Programming

Editors IDEs
Installation
Handhelds / PDAs
Multimedia Programming
System / Kernel
Automation

Algorithms
Game
Signal Processing
Project Management
Open Source
Database

Misc
Languages
Processor Platforms
Theory

Web Development

Scripting
Blogs
Web Servers
Software
Search Engines
Web Graphics
Web Services

Images
Internet Marketing
Images and Photos
Components
Document Imaging
Web Languages/Standards
Illustration

WebApplications
Fonts
WebTrends / Stats
Authoring
Digital Camera Software
Miscellaneous

Networking

Protocols
Apple Networking
Network Management
Message Queue
Application Servers
Content Management
File Servers
Email Servers
Misc
Java Editors & IDEs

Wireless
Networking Hardware
Backup / Restore
System Utilities
ISPs & Hosting
Web Servers
Storage Technology
Removable Backup Media
Servers
Web Computing

Broadband
Grid
OS / 2
Novell Netware
Unix Networking
Windows Networking
Security
Telecommunications
Operating Systems
Linux Networking

Other

Lounge
Business Travel
Community Support
New Net Users

Philosophy / Religion
Math / Science
Miscellaneous
URLs

Expert Lounge
Politics
Puzzles / Riddles
Automotive

Community Support

Suggestions
New to EE
New Topics
CleanUp

Announcements
General
Feedback

Input
EE Bugs

01.10.2008 at 05:53AM PST, ID: 20627070

Rank: Sage

giltjr:

Need some more information. Such as what type of firewall do you have? What type of Web server do you have?

Are you saying that your web server is sent 400GB of data to some other server in one night?

Check your web server's log to see what files were being pulled.

Assisted Solution

01.13.2008 at 06:51AM PST, ID: 20647807

WebJoe:

firewall= sonicwall 4060
webserver = iis6 (all patches installed)

It is outgoing traffic to ip address where when I check them it is allways a gameserver site. They are never a lot ip addresses involved the max in one night are 5. Most of them USA ip's sometimes Germany

Please see the code snippet for details of one packet.

                       
         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:

           
           
             Packet Info:
    Packet Number:                      071613
    Packet Length:                      1518
    Capture Length:                     1514
    Timestamp:                          2008-01-12 19:23:16.911182
Ethernet Type II                        [0/14]
    Destination Address:                00:06:--:--:--:--  (Sonicwall)  [0/6]
    Source Address:                     00:0B:--:--:--:--  (Compaq)  [6/6]
    Protocol:                           0x0800  (Internet IP (IPv4))  [12/2]
IP - Internet Protocol                  [14/20]
    Version:                            4  [14/1]  0x00F0
    Header Length:                      5  (20 Bytes)  [14/1]  0x000F
    Differentiated Services Field:      0000 0000  [15/1]  0x00FF
        Differentiated Services Codepoint:0000 00..  (Default)  [15/1]  0x00FC
        Transport Protocol will ignore the CE bit:.... ..0.  (Ignore)  [15/1]  0x0002
        Congestion:                     .... ...0  (No Congestion)  [15/1]  0x0001
    Total Length:                       1500  (1500 Bytes)  [16/2]
    Identification:                     0x1C76  (7286)  [18/2]
    Fragment Flags:                     001. ....  (More Fragment)  [20/1]  0x00E0
        Reserved:                       0... ....  [20/1]  0x0080
        Fragment:                       .0.. ....  (May Fragment)  [20/1]  0x0040
        More Fragment:                  ..1. ....  (More Fragment)  [20/1]  0x0020
    Fragment Offset:                    370  [20/2]  0x1FFF
    Time To Live:                       128  [22/1]
    Protocol:                           17  (UDP)  [23/1]
    Checksum:                           0xD14F  (Correct)  [24/2]
    Source IP:                          -.-.-.-  [26/4]
    Destination IP:                     -.-.-.-  [30/4]
    No IP Option                        [34/0]
Extra Data:                             [34/1480]
    Number of Bytes:                    1480 bytes  [34/1480]
FCS - Frame Check Sequence:
    FCS:                                0xDE8A7C4F  (Calculated)
           
         

Open in New Window

01.13.2008 at 08:06AM PST, ID: 20647988

Rank: Sage

giltjr:

I would just start blocking the IP addresses as you find them.

I would be real concerned about the possibility that your system has been compromised. Especially if your system is initiating the connection to them. Can you tell if you are initiating out, or if they are initiating in? Not the direction the bulk of the data is going, but who actually initiates the connection.

Can you tell what the data is?

Accepted Solution

01.17.2008 at 05:06AM PST, ID: 20680780

_ee:

What services does your web server use? Depending on the answer to that, you may want to block all UDP traffic. A lot of games use this protocol, and if your server is only a web server, for example, then you have no need for this protocol anyway.

Assisted Solution

20080716-EE-VQP-33 / EE_QW_2_20070628