EOS Epic Game DDOS attacks

Just to add to this. He is openly bragging about it on Discord. He says he is doing this by:

"some ddos's can emulate packets that are used in game and = impossible to block"

"a2s player query spam could be deadly, not not a lot of people know about it"

 

He is using "a2s" to spam my server with queries, causing it to crash repeatedly. Eventually, it causes my port to get locked and I am forced to reboot the host machine.

 

I'd argue thats a bug topic, but why not to have a discussion here...

You can't rely on devs on keeping up security notched up. You can't rely on them making any safety things whatsoever actually. Probably should expect patching of critical vulnerabilities though, but its not very likely they have security concepts integrated deeply, so unless someone reports it, it would be there...

 

If you would have been using Linux and wished to just block his IP, I'd have suggested looking into iptables/ipset/eBPF. That doesn't offer quite enough protection to call game server safe, but thats an instrument to block sources of attacks at least.

If you would like to lower amount of incoming requests - load balancers are probably a way to go (though its likely that Linux OS offers control over it, but Im not fluent with core functionality of it). I know that HAProxy and Nginx can be used as L3/L4 load balancers, but I have little idea on what options of flow control they offer for TCP. Like, both can limit/delay incoming HTTP messages well, but TCP (especially on ClientHello stage of TLS) - I possess no such knowledge. Proper rules will probably solve your problem or minimize risks to acceptable levels. Thats a big research topic though. Add processing (for the sake of filtering) of incoming packets for best results.

 

 

Also, you can dump his TCP packets by using tcpdump or something alike, while filtering by attacker host ip which you know. I bet that would be of help to devs (a valid test case at least) if they ever decide to work on it.

Diablo said it well. I will be doing some research on it and see if there's anything the networking folks can do or not, but there are likely by now millions of ways to DOS a server, most of them not exploiting anything vulnerable in games.