Tekil Mesaj gösterimi - UDP,TCP Saldırıları alıyorum [Yardım]

Konu UDP,TCP Saldırıları alıyorum [Yardım]

28-06-2014, 15:58:55

#1

Turktakimi

Merhaba, TeamSpeak sunucularım var OVH'nın firewall sistemine rağmen bu ssh den yapılan saldırılar ./xxx ip port komutuyla 10 saniyede TS mi kapatıyor

(bu iptal ettiğim makinemin logu) (UDP)

Alıntı

Jun 26 15:59:38 81.77.89.26 18325 in 37.187.61.145 45008 UDP
Jun 26 15:59:40 81.83.105.38 41460 in 37.187.61.145 27152 UDP
Jun 26 15:59:32 81.64.85.102 55741 in 37.187.61.145 542 UDP
Jun 26 15:59:34 81.76.252.179 22654 in 37.187.61.145 54809 UDP
Jun 26 15:59:36 81.54.123.74 41745 in 37.187.61.145 15120 UDP
Jun 26 15:59:28 81.220.46.209 32435 in 37.187.61.145 25615 UDP
Jun 26 15:59:30 81.225.57.223 55779 in 37.187.61.145 55753 UDP
Jun 26 15:59:22 81.232.196.11 6610 in 37.187.61.145 35684 UDP
Jun 26 15:59:24 81.234.22.250 53614 in 37.187.61.145 53980 UDP
Jun 26 15:59:26 81.207.164.138 35513 in 37.187.61.145 13101 UDP
Jun 26 15:59:18 81.25.182.16 26351 in 37.187.61.145 37203 UDP
Jun 26 15:59:20 81.27.201.3 63324 in 37.187.61.145 35236 UDP
Jun 26 15:59:12 81.173.102.177 25104 in 37.187.61.145 13164 UDP
Jun 26 15:59:14 81.102.192.171 18763 in 37.187.61.145 14652 UDP
Jun 26 15:59:16 81.151.202.155 60655 in 37.187.61.145 37808 UDP
Jun 26 15:59:08 81.230.169.96 17420 in 37.187.61.145 55079 UDP
Jun 26 15:59:10 81.216.121.149 3261 in 37.187.61.145 21413 UDP
Jun 26 15:59:02 81.213.254.13 44426 in 37.187.61.145 17800 UDP
Jun 26 15:59:04 81.201.211.90 51464 in 37.187.61.145 7096 UDP
Jun 26 15:59:06 81.33.4.205 19454 in 37.187.61.145 40731 UDP
Jun 26 15:58:58 81.35.81.134 31260 in 37.187.61.145 17336 UDP
Jun 26 15:59:00 81.24.17.162 37628 in 37.187.61.145 22035 UDP
Jun 26 15:58:54 81.179.209.109 54478 in 37.187.61.145 5851 UDP
Jun 26 15:58:52 81.23.3.166 6148 in 37.187.61.145 63591 UDP
Jun 26 15:58:56 81.119.196.173 35498 in 37.187.61.145 52924 UDP
Jun 26 15:58:48 81.237.62.130 27036 in 37.187.61.145 34242 UDP
Jun 26 15:58:50 81.31.252.220 19464 in 37.187.61.145 55711 UDP
Jun 26 15:58:42 81.155.0.88 44600 in 37.187.61.145 52849 UDP
Jun 26 15:58:44 81.235.185.68 61278 in 37.187.61.145 46401 UDP
Jun 26 15:58:46 81.19.88.124 5843 in 37.187.61.145 1472 UDP
Jun 26 15:58:40 81.119.84.38 29385 in 37.187.61.145 53476 UDP
Jun 26 15:58:38 81.232.18.245 47014 in 37.187.61.145 35882 UDP
Jun 26 15:58:36 81.19.149.62 13020 in 37.187.61.145 371 UDP
Jun 26 15:58:34 81.252.135.116 8181 in 37.187.61.145 45544 UDP
Jun 26 15:58:34 81.147.233.125 52154 in 37.187.61.145 52171 UDP
Jun 26 15:58:34 81.193.97.213 12208 in 37.187.61.145 46259 UDP
Jun 26 15:58:34 81.41.214.249 54501 in 37.187.61.145 6436 UDP
Jun 26 15:58:34 81.70.84.81 55149 in 37.187.61.145 33260 UDP

buda şuanki başka bir arkadaşın saldırısındaki log (TCP)

Alıntı

Jun 28 12:58:21 sunucu kernel: [214869.520430] Firewall: *SYNFLOOD Blocked* IN=venet0 OUT= MAC= SRC=85.222.54.187 DST=37.187.58.64 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=6328 DF PROTO=TCP SPT=45529 DPT=22 WINDOW=15536 RES=0x00 SYN URGP=0
Jun 28 12:58:21 sunucu kernel: [214869.520454] Firewall: *SYNFLOOD Blocked* IN=venet0 OUT= MAC= SRC=85.183.33.233 DST=37.187.58.64 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=28327 DF PROTO=TCP SPT=57387 DPT=22 WINDOW=15536 RES=0x00 SYN URGP=0
Jun 28 12:58:21 sunucu kernel: [214869.520473] Firewall: *SYNFLOOD Blocked* IN=venet0 OUT= MAC= SRC=85.225.150.132 DST=37.187.58.64 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=3910 DF PROTO=TCP SPT=62950 DPT=22 WINDOW=15536 RES=0x00 SYN URGP=0
Jun 28 12:58:21 sunucu kernel: [214869.520485] Firewall: *SYNFLOOD Blocked* IN=venet0 OUT= MAC= SRC=85.170.234.54 DST=37.187.58.64 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=23207 DF PROTO=TCP SPT=17227 DPT=22 WINDOW=15536 RES=0x00 SYN URGP=0
Jun 28 12:58:21 sunucu kernel: [214869.520501] Firewall: *SYNFLOOD Blocked* IN=venet0 OUT= MAC= SRC=85.50.92.87 DST=37.187.58.64 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=43711 DF PROTO=TCP SPT=60881 DPT=22 WINDOW=15536 RES=0x00 SYN URGP=0
Jun 28 12:58:21 sunucu kernel: [214869.573045] Firewall: *INVALID* IN=venet0 OUT= MAC= SRC=85.72.118.53 DST=37.187.58.64 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=39486 PROTO=TCP SPT=15382 DPT=22 WINDOW=0 RES=0x00 RST URGP=0
Jun 28 12:58:22 sunucu kernel: [214869.612672] Firewall: *INVALID* IN=venet0 OUT= MAC= SRC=85.106.121.209 DST=37.187.58.64 LEN=40 TOS=0x00 PREC=0x00 TTL=241 ID=62785 PROTO=TCP SPT=19870 DPT=22 WINDOW=0 RES=0x00 RST URGP=0

Fiziksel firewall vs. alma gibi bir imkanım yok vpsler ovh'da csf çare etmedi yok mu bunun başka bir yolu ?

Teşekkürler.