New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
UDP broadcast spamming on VPS
So there's this guy on the same node as I and two days ago he started broadcast-spamming UDP packets to port 1900 like a madman to all VPS' on the same node and the provider tells me that this is completely normal.
Shouldn't there be some sort of isolation on layer 4 and upwards?
What do you think?
Comments
Just iptables the traffic out
Filter it out or perhaps contact the provider with the offending IP's?
Hum, while that is normal, in general, at that level of traffic is not, he might have some misconfiguration.
UPnP
mey be you can use this at sysctl.conf
net.ipv4.icmp_echo_ignore_broadcasts = 1
Thanks but judging from the name it only works for ICMP, not UDP.
I was unable to filter the traffic from the SNMP counters, not even with a PREROUTING rule in the raw table, which is one of the first tables being processed by Netfilter AFAIK.
(one minute later)... I just checked the SNMP graphs and the problem has been resolved either by the user or the provider. Thanks for your inputs, guys!
Broadcast traffic is normal, that level of broadcast traffic is bat shit insane, your provider need to act not you. just lol.