1

I have a vps at hetzner.de with vmware running several instances, one of them is an Ubuntu server 13.10, primarily acting as mysql-server for several websites. Today I received an email from hetzner, saying that they have received a spam/abuse notification:

My IP xx.xx.xx.xx is being ddosed from your network All ips that attack me belong to Hetzner Attack speed is more than 1gbit\s

PROTO=UDP SPT=10000 DPT=80 DST=xx.xx.xx.xx

IP addresses that are attacking me: Feb 9 19:27:07 srv1 kernel: [ 112.236968] Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=yy:yy:yy:yy:yy:yy:yy:yy:yy:yy:yy:yy:yy:yy SRC=zz.zz.zz.zz DST=xx.xx.xx.xx LEN=1396 TOS=0x00 PREC=0x00 TTL=246 ID=22304 PROTO=UDP SPT=10000 DPT=80 LEN=1376

I'm using UFW, and this is the result of "ufw status":

34/tcp allow anywhere

22/tcp allow anywhere

3306/tcp allow aa.aa.aa.aa

3306/tcp allow bb.bb.bb.bb

3306/tcp allow cc.cc.cc.cc

3306/tcp allow dd.dd.dd.dd

34/tcp allow anywhere (v6)

22/tcp allow anywhere (v6)

ports 22 and 34 are used for ssh only accessible with private key. port 3306 is used for the mysql-connections from webservers and developer machines

I can't see anything unusual in my auth.log

Can anyone help me figuring this one out?

Thanks

Improve this question
3
  • I have the same problem. I have a virtual server in hetzner, and received the same notification. The source and destination ports are the same. And also received the notification today.
    – jperelli
    Feb 10, 2014 at 14:17
  • 1
    The DPT=80 shows that they are hitting the HTTP port if that sheds any light on the problem.
    – douggro
    Feb 10, 2014 at 14:45
  • Is there anywhere (in ubuntu) I can check if my server really made that traffic to port 80 on xx.xx.xx.xx?
    – majbom
    Feb 12, 2014 at 12:44

3 Answers 3

Reset to default
1

I got similar letter from [email protected] yestoday. It have text from "attacked" administrator as your letter.

I checked my server - all Ok. Nothing illegal activity.

I think somebody wants to joke with Hetzner abuse support. Or want to down some servers.

Improve this answer
0

According to a little more of research and hetzner feedback, it seems like is an IP spoofing problem ie: false source ip information.

It seems like the attacker used (falsed) hetzner ips as source ip from the attack packets.

So if you don't find any problem, it seems it was all false alarm for us.

Improve this answer
1
  • Well, I also have an idea that it's not serious abuse notifications. 3 months ago I got another one, with another of my ips, I answered the mail, via the link they provided for their abuse-system, but I have never heard from them again regarding this "ticket". I just don't want to risk that they close my account - I have a lot of important sites running.
    – majbom
    Feb 11, 2014 at 19:04
0

Yes. I am analyse outgoing traffic also for 9 Feb. DOS activity is absent.

Hetzner abuse support and attacked administrator is not respond on my letter.

I am afraid for turning of my server from external network by mistake. Hetzner is practic this action because of DOS to client server or DOS out from client server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .