Results 1 to 20 of 20
  1. #1
    Join Date
    Sep 2004
    Posts
    40

    Arrow Advice, I am under DDos Attack



    Hardware Information: Intel Celeron 2.4 - 80GB - 1024MB - 1200GB

    I have a server with Staminus.net with one site, hosting one forum with about 1000 visitors each day.

    I have a big problem that I am attacked with DDos every day. And need advice about it.

    See the load for today :

    load average: 181.45,
    load average: 309.56,
    load average: 157.41,
    load average: 420.24,
    load average: 126.42,
    load average: 991.32,
    load average: 531.27

    you can see the log of DDos Attack here ...

    ==================

    Attack Destination:
    Start Time: [Sun Sep 24 23:27:24 2006]
    End Time: [Sun Sep 24 23:57:16 2006]
    Rate: 2,739,272 Packets Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 01:20:44 2006]
    End Time: [Mon Sep 25 04:43:56 2006]
    Rate: 18,447 Packets Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 04:49:16 2006]
    End Time: [Mon Sep 25 06:49:56 2006]
    Rate: 168,486 Packets Per Second

    Attack Destination:
    Start Time: [Tue Sep 26 01:29:00 2006]
    End Time: [Tue Sep 26 01:29:56 2006]
    Rate: 332,424 Packets Per Second

    Attack Destination:
    Start Time: [Tue Sep 26 04:21:24 2006]
    End Time: [Tue Sep 26 04:47:20 2006]
    Rate: 18,277 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 01:45:41 2006]
    End Time: [Thu Oct 5 03:08:33 2006]
    Rate: 97,789 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 03:10:45 2006]
    End Time: [Thu Oct 5 04:38:33 2006]
    Rate: 321,181 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 10:24:45 2006]
    End Time: [Thu Oct 5 12:33:57 2006]
    Rate: 1,809,283 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 18:03:49 2006]
    End Time: [Thu Oct 5 21:58:57 2006]
    Rate: 1,950,356 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 20:52:33 2006]
    End Time: [Thu Oct 5 23:45:41 2006]
    Rate: 1,982,569 Packets Per Second

    Attack Destination:
    Start Time: [Thu Oct 5 20:56:37 2006]
    End Time: [Thu Oct 5 23:55:49 2006]
    Rate: 1,469,548 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 00:05:41 2006]
    End Time: [Fri Oct 6 01:35:37 2006]
    Rate: 2,143,083 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 00:13:45 2006]
    End Time: [Fri Oct 6 01:28:33 2006]
    Rate: 1,052,099 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 00:18:49 2006]
    End Time: [Fri Oct 6 01:35:05 2006]
    Rate: 1,976,973 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 03:45:25 2006]
    End Time: [Fri Oct 6 04:42:05 2006]
    Rate: 18,178 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 03:46:37 2006]
    End Time: [Fri Oct 6 04:59:41 2006]
    Rate: 293,628 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 04:00:01 2006]
    End Time: [Fri Oct 6 04:45:05 2006]
    Rate: 644,534 KiloBits Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 18:21:41 2006]
    End Time: [Fri Oct 6 18:22:33 2006]
    Rate: 106,478 Packets Per Second

    Attack Destination:
    Start Time: [Fri Oct 6 19:10:29 2006]
    End Time: [Fri Oct 6 19:10:29 2006]
    Rate: 78,086 Packets Per Second


    Attack Destination:
    Start Time: [Sun Oct 8 06:14:45 2006]
    End Time: [Sun Oct 8 06:14:45 2006]
    Rate: 18,493 Packets Per Second


    =====================

    DDoS Report Log

    23:22:24.158788 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 211.212.64.160.906 > **.**.**.***.80: . [bad tcp cksum 367a (->7cae)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 d940 d3d4 40a0 E..<....n..@..@.
    0x010: 4814 15f3 038a 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 367a 0000 0000 0000 5010 0200 P...6z......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159042 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.413 > **.**.**.***.80: . [bad tcp cksum ba5d (->92)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 019d 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 ba5d 0000 0000 0000 5010 0200 P....]......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159097 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.193 > **.**.**.***.80: . [bad tcp cksum b2ce (->1d0e)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 00c1 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b2ce 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159244 IP (tos 0x0, ttl 109, id 256, offset 0, flags [none], length: 60) 124.2.88.160.15 > **.**.**.***.80: . [bad tcp cksum 93b8 (->bffb)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6d06 1a13 7c02 58a0 E..<....m...|.X.
    0x010: 4814 15f3 000f 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 93b8 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159323 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 59.22.87.45.616 > **.**.**.***.80: . [bad tcp cksum f89f (->2)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 5972 3b16 572d E..<....p.Yr;.W-
    0x010: 4814 15f3 0268 0050 1234 5678 0000 0000 H....h.P.4Vx....
    0x020: 5010 0200 f89f 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159367 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.798 > **.**.**.***.80: . [bad tcp cksum b8dc (->ff10)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 031e 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b8dc 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159573 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.512 > **.**.**.***.80: . [bad tcp cksum b9fa (->2f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 0200 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b9fa 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159611 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.1018 > **.**.**.***.80: . [bad tcp cksum 396d (->7f81)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 03fa 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 396d 0000 0000 0000 5010 0200 P...9m......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159730 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.72 > **.**.**.***.80: . [bad tcp cksum 3d1f (->8333)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0048 0050 1234 5678 0000 0000 H....H.P.4Vx....
    0x020: 5010 0200 3d1f 0000 0000 0000 5010 0200 P...=.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159811 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 222.237.108.246.411 > **.**.**.***.80: . [bad tcp cksum 985e (->472e)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 a1d1 deed 6cf6 E..<....n.....l.
    0x010: 4814 15f3 019b 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 985e 0000 0000 0000 5010 0200 P....^......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159843 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.378 > **.**.**.***.80: . [bad tcp cksum a1bc (->e7f0)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 017a 0050 1234 5678 0000 0000 H....z.P.4Vx....
    0x020: 5010 0200 a1bc 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160011 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 210.118.224.125.540 > **.**.**.***.80: . [bad tcp cksum 6c44 (->df9c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 38c1 d276 e07d E..<....p.8..v.}
    0x010: 4814 15f3 021c 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 6c44 0000 0000 0000 5010 0200 P...lD......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160043 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.938 > **.**.**.***.80: . [bad tcp cksum 39bd (->7fd1)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 03aa 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 39bd 0000 0000 0000 5010 0200 P...9.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160081 IP (tos 0x0, ttl 114, id 63172, offset 0, flags [none], length: 60) 203.252.131.195.721 > **.**.**.***.80: . [bad tcp cksum 628c (->421c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c f6c4 0000 7206 a430 cbfc 83c3 E..<....r..0....
    0x010: 4814 15f3 02d1 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 628c 0000 0000 0000 5010 0200 P...b.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160281 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 210.113.118.228.435 > **.**.**.***.80: . [bad tcp cksum 8265 (->49a4)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 a15f d271 76e4 E..<....q.._.qv.
    0x010: 4814 15f3 01b3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 8265 0000 0000 0000 5010 0200 P....e......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160314 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 219.254.111.124.819 > **.**.**.***.80: . [bad tcp cksum ffca (->45ff)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 a03a dbfe 6f7c E..<....p..:..o|
    0x010: 4814 15f3 0333 0050 1234 5678 0000 0000 H....3.P.4Vx....
    0x020: 5010 0200 ffca 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160344 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.589 > **.**.**.***.80: . [bad tcp cksum b9ad (->ffe1)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 024d 0050 1234 5678 0000 0000 H....M.P.4Vx....
    0x020: 5010 0200 b9ad 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160452 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.643 > **.**.**.***.80: . [bad tcp cksum b10c (->1b4c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 0283 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b10c 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160490 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.13 > **.**.**.***.80: . [bad tcp cksum b382 (->1dc2)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 000d 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b382 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158895 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 211.212.64.160.270 > **.**.**.***.80: . [bad tcp cksum 38f6 (->7f2a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 d940 d3d4 40a0 E..<....n..@..@.
    0x010: 4814 15f3 010e 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 38f6 0000 0000 0000 5010 0200 P...8.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158897 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 210.118.224.125.421 > **.**.**.***.80: . [bad tcp cksum 6cbb (->e013)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 38c1 d276 e07d E..<....p.8..v.}
    0x010: 4814 15f3 01a5 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 6cbb 0000 0000 0000 5010 0200 P...l.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158898 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.652 > **.**.**.***.80: . [bad tcp cksum b103 (->1b43)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 028c 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b103 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158900 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.730 > **.**.**.***.80: . [bad tcp cksum b0b5 (->1af5)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 02da 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b0b5 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158901 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.475 > **.**.**.***.80: . [bad tcp cksum ba1f (->54)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 01db 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 ba1f 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158902 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.853 > **.**.**.***.80: . [bad tcp cksum 3a12 (->8026)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0355 0050 1234 5678 0000 0000 H....U.P.4Vx....
    0x020: 5010 0200 3a12 0000 0000 0000 5010 0200 P...:.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158904 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.830 > **.**.**.***.80: . [bad tcp cksum 3a29 (->803d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 033e 0050 1234 5678 0000 0000 H....>.P.4Vx....
    0x020: 5010 0200 3a29 0000 0000 0000 5010 0200 P.........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158905 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.559 > **.**.**.***.80: . [bad tcp cksum 3b38 (->814c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 022f 0050 1234 5678 0000 0000 H..../.P.4Vx....
    0x020: 5010 0200 3b38 0000 0000 0000 5010 0200 P...;8......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158907 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.171 > **.**.**.***.80: . [bad tcp cksum 3cbc (->82d0)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 00ab 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3cbc 0000 0000 0000 5010 0200 P...<.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158908 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.825 > **.**.**.***.80: . [bad tcp cksum 3a2e (->8042)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0339 0050 1234 5678 0000 0000 H....9.P.4Vx....
    0x020: 5010 0200 3a2e 0000 0000 0000 5010 0200 P...:.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158909 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.245 > **.**.**.***.80: . [bad tcp cksum 3c72 (->8286)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 00f5 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3c72 0000 0000 0000 5010 0200 P... 0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158915 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 222.109.186.148.306 > **.**.**.***.80: . [bad tcp cksum 4ba9 (->fa78)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 51b3 de6d ba94 E..<....q.Q..m..
    0x010: 4814 15f3 0132 0050 1234 5678 0000 0000 H....2.P.4Vx....
    0x020: 5010 0200 4ba9 0000 0000 0000 5010 0200 P...K.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158917 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.885 > **.**.**.***.80: . [bad tcp cksum 9fc1 (->e5f5)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 0375 0050 1234 5678 0000 0000 H....u.P.4Vx....
    0x020: 5010 0200 9fc1 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158920 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.244 > **.**.**.***.80: . [bad tcp cksum a242 (->e876)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 00f4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 a242 0000 0000 0000 5010 0200 P....B......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158921 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 210.118.224.125.796 > **.**.**.***.80: . [bad tcp cksum 6b44 (->de9c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 38c1 d276 e07d E..<....p.8..v.}
    0x010: 4814 15f3 031c 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 6b44 0000 0000 0000 5010 0200 P...kD......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158923 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.11.81.243.879 > **.**.**.***.80: . [bad tcp cksum 2842 (->440)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5db7 3b0b 51f3 E..<....q.].;.Q.
    0x010: 4814 15f3 036f 0050 1234 5678 0000 0000 H....o.P.4Vx....
    0x020: 5010 0200 2842 0000 0000 0000 5010 0200 P...(B......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158924 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.11.81.243.510 > **.**.**.***.80: . [bad tcp cksum 29b3 (->5b1)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5db7 3b0b 51f3 E..<....q.].;.Q.
    0x010: 4814 15f3 01fe 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 29b3 0000 0000 0000 5010 0200 P...).......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158925 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 61.4.207.186.478 > **.**.**.***.80: . [bad tcp cksum 12b8 (->8610)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 dff6 3d04 cfba E..<....o...=...
    0x010: 4814 15f3 01de 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 12b8 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158926 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 61.102.200.150.801 > **.**.**.***.80: . [bad tcp cksum 1837 (->8b8f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 e3b8 3d66 c896 E..<....r...=f..
    0x010: 4814 15f3 0321 0050 1234 5678 0000 0000 H....!.P.4Vx....
    0x020: 5010 0200 1837 0000 0000 0000 5010 0200 P....7......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158928 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 61.102.200.150.995 > **.**.**.***.80: . [bad tcp cksum 1775 (->8acd)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 e3b8 3d66 c896 E..<....r...=f..
    0x010: 4814 15f3 03e3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 1775 0000 0000 0000 5010 0200 P....u......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158929 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 61.102.200.150.876 > **.**.**.***.80: . [bad tcp cksum 17ec (->8b44)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 e3b8 3d66 c896 E..<....r...=f..
    0x010: 4814 15f3 036c 0050 1234 5678 0000 0000 H....l.P.4Vx....
    0x020: 5010 0200 17ec 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158930 IP (tos 0x0, ttl 114, id 63173, offset 0, flags [none], length: 60) 203.252.131.195.446 > **.**.**.***.80: . [bad tcp cksum 639f (->432f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c f6c5 0000 7206 a42f cbfc 83c3 E..<....r../....
    0x010: 4814 15f3 01be 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 639f 0000 0000 0000 5010 0200 P...c.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158932 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 61.102.200.150.5 > **.**.**.***.80: . [bad tcp cksum 1b53 (->8eab)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 e3b8 3d66 c896 E..<....r...=f..
    0x010: 4814 15f3 0005 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 1b53 0000 0000 0000 5010 0200 P....S......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158933 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.542 > **.**.**.***.80: . [bad tcp cksum a118 (->e74c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 021e 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 a118 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158935 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 59.22.87.45.461 > **.**.**.***.80: . [bad tcp cksum f93a (->9d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 5972 3b16 572d E..<....p.Yr;.W-
    0x010: 4814 15f3 01cd 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 f93a 0000 0000 0000 5010 0200 P....:......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.158936 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.356 > **.**.**.***.80: . [bad tcp cksum ba96 (->cb)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 0164 0050 1234 5678 0000 0000 H....d.P.4Vx....
    0x020: 5010 0200 ba96 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159126 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.244 > **.**.**.***.80: . [bad tcp cksum bb06 (->13b)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 00f4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 bb06 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159129 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 59.22.87.45.467 > **.**.**.***.80: . [bad tcp cksum f934 (->97)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 5972 3b16 572d E..<....p.Yr;.W-
    0x010: 4814 15f3 01d3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 f934 0000 0000 0000 5010 0200 P....4......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159250 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.880 > **.**.**.***.80: . [bad tcp cksum b01f (->1a5f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 0370 0050 1234 5678 0000 0000 H....p.P.4Vx....
    0x020: 5010 0200 b01f 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159377 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.979 > **.**.**.***.80: . [bad tcp cksum 9f63 (->e597)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 03d3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9f63 0000 0000 0000 5010 0200 P....c......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159379 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 222.237.108.246.736 > **.**.**.***.80: . [bad tcp cksum 9719 (->45e9)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 a1d1 deed 6cf6 E..<....n.....l.
    0x010: 4814 15f3 02e0 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9719 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159626 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.984 > **.**.**.***.80: . [bad tcp cksum 9f5e (->e592)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 03d8 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9f5e 0000 0000 0000 5010 0200 P....^......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159629 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 220.71.131.76.1021 > **.**.**.***.80: . [bad tcp cksum eae7 (->311c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 8b21 dc47 834c E..<....q..!.G.L
    0x010: 4814 15f3 03fd 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 eae7 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159750 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 219.254.111.124.454 > **.**.**.***.80: . [bad tcp cksum 138 (->476c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 a03a dbfe 6f7c E..<....p..:..o|
    0x010: 4814 15f3 01c6 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 0138 0000 0000 0000 5010 0200 P....8......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159875 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 61.4.207.186.612 > **.**.**.***.80: . [bad tcp cksum 1232 (->858a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 dff6 3d04 cfba E..<....o...=...
    0x010: 4814 15f3 0264 0050 1234 5678 0000 0000 H....d.P.4Vx....
    0x020: 5010 0200 1232 0000 0000 0000 5010 0200 P....2......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.159877 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 220.71.131.76.617 > **.**.**.***.80: . [bad tcp cksum ec7b (->32b0)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 8b21 dc47 834c E..<....q..!.G.L
    0x010: 4814 15f3 0269 0050 1234 5678 0000 0000 H....i.P.4Vx....
    0x020: 5010 0200 ec7b 0000 0000 0000 5010 0200 P....{......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160125 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 222.237.108.246.834 > **.**.**.***.80: . [bad tcp cksum 96b7 (->4587)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 a1d1 deed 6cf6 E..<....n.....l.
    0x010: 4814 15f3 0342 0050 1234 5678 0000 0000 H....B.P.4Vx....
    0x020: 5010 0200 96b7 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160128 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 222.107.96.98.43 > **.**.**.***.80: . [bad tcp cksum c744 (->55b4)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 aae7 de6b 6062 E..<....r....k`b
    0x010: 4814 15f3 002b 0050 1234 5678 0000 0000 H....+.P.4Vx....
    0x020: 5010 0200 c744 0000 0000 0000 5010 0200 P....D......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160130 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 58.77.117.83.735 > **.**.**.***.80: . [bad tcp cksum 9bf9 (->e22d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 3c15 3a4d 7553 E..<....p.<.:MuS
    0x010: 4814 15f3 02df 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9bf9 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160376 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.389 > **.**.**.***.80: . [bad tcp cksum ba75 (->aa)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 0185 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 ba75 0000 0000 0000 5010 0200 P....u......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160378 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.11.81.243.33 > **.**.**.***.80: . [bad tcp cksum 2b90 (->78e)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5db7 3b0b 51f3 E..<....q.].;.Q.
    0x010: 4814 15f3 0021 0050 1234 5678 0000 0000 H....!.P.4Vx....
    0x020: 5010 0200 2b90 0000 0000 0000 5010 0200 P...+.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160380 IP (tos 0x0, ttl 115, id 256, offset 0, flags [none], length: 60) 124.5.213.145.995 > **.**.**.***.80: . [bad tcp cksum cbda (->3f33)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7306 971e 7c05 d591 E..<....s...|...
    0x010: 4814 15f3 03e3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 cbda 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160499 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 221.138.243.7.976 > **.**.**.***.80: . [bad tcp cksum 7a16 (->c04a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 1c23 dd8a f307 E..<....o..#....
    0x010: 4814 15f3 03d0 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 7a16 0000 0000 0000 5010 0200 P...z.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160502 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 210.118.224.125.935 > **.**.**.***.80: . [bad tcp cksum 6ab9 (->de11)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 38c1 d276 e07d E..<....p.8..v.}
    0x010: 4814 15f3 03a7 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 6ab9 0000 0000 0000 5010 0200 P...j.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160624 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 61.4.207.186.945 > **.**.**.***.80: . [bad tcp cksum 10e5 (->843d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 dff6 3d04 cfba E..<....o...=...
    0x010: 4814 15f3 03b1 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 10e5 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160627 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.208 > **.**.**.***.80: . [bad tcp cksum bb2a (->15f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 00d0 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 bb2a 0000 0000 0000 5010 0200 P....*......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160628 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 222.107.96.98.1015 > **.**.**.***.80: . [bad tcp cksum c378 (->51e8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 aae7 de6b 6062 E..<....r....k`b
    0x010: 4814 15f3 03f7 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 c378 0000 0000 0000 5010 0200 P....x......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160887 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 61.95.154.49.1018 > **.**.**.***.80: . [bad tcp cksum 9959 (->b922)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 1525 3d5f 9a31 E..<....o..%=_.1
    0x010: 4814 15f3 03fa 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9959 0000 0000 0000 5010 0200 P....Y......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.160889 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.500 > **.**.**.***.80: . [bad tcp cksum 3b73 (->8187)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 01f4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3b73 0000 0000 0000 5010 0200 P...;s......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161000 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.577 > **.**.**.***.80: . [bad tcp cksum 3b26 (->813a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0241 0050 1234 5678 0000 0000 H....A.P.4Vx....
    0x020: 5010 0200 3b26 0000 0000 0000 5010 0200 P...;&......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161124 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 211.177.160.144.986 > **.**.**.***.80: . [bad tcp cksum 6dc1 (->1c91)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 7973 d3b1 a090 E..<....n.ys....
    0x010: 4814 15f3 03da 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 6dc1 0000 0000 0000 5010 0200 P...m.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161127 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.11.81.243.648 > **.**.**.***.80: . [bad tcp cksum 2929 (->527)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5db7 3b0b 51f3 E..<....q.].;.Q.
    0x010: 4814 15f3 0288 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 2929 0000 0000 0000 5010 0200 P...))......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161128 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.428 > **.**.**.***.80: . [bad tcp cksum a18a (->e7be)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 01ac 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 a18a 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161250 IP (tos 0x0, ttl 107, id 256, offset 0, flags [none], length: 60) 85.231.85.204.231 > **.**.**.***.80: . [bad tcp cksum 3963 (->e812)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6b06 4502 55e7 55cc E..<....k.E.U.U.
    0x010: 4814 15f3 00e7 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3963 0000 0000 0000 5010 0200 P...9c......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161252 IP (tos 0x0, ttl 116, id 256, offset 0, flags [none], length: 60) 218.144.120.220.188 > **.**.**.***.80: . [bad tcp cksum e16b (->4084)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7406 9448 da90 78dc E..<....t..H..x.
    0x010: 4814 15f3 00bc 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 e16b 0000 0000 0000 5010 0200 P....k......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161375 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 222.237.108.30.2 > **.**.**.***.80: . [bad tcp cksum 5ec8 (->499f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 a2a9 deed 6c1e E..<....n.....l.
    0x010: 4814 15f3 0002 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 5ec8 0000 0000 0000 5010 0200 P...^.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161378 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 221.149.227.25.576 > **.**.**.***.80: . [bad tcp cksum e6e6 (->d1bd)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 2906 dd95 e319 E..<....r.).....
    0x010: 4814 15f3 0240 0050 1234 5678 0000 0000 H....@.P.4Vx....
    0x020: 5010 0200 e6e6 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161379 IP (tos 0x0, ttl 114, id 62377, offset 0, flags [none], length: 60) 203.252.131.195.671 > **.**.**.***.80: . [bad tcp cksum 62be (->424e)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c f3a9 0000 7206 a74b cbfc 83c3 E..<....r..K....
    0x010: 4814 15f3 029f 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 62be 0000 0000 0000 5010 0200 P...b.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161499 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.1024 > **.**.**.***.80: . [bad tcp cksum 9f36 (->e56a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 0400 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9f36 0000 0000 0000 5010 0200 P....6......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161626 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 58.77.117.83.677 > **.**.**.***.80: . [bad tcp cksum 9c33 (->e267)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 3c15 3a4d 7553 E..<....p.<.:MuS
    0x010: 4814 15f3 02a5 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9c33 0000 0000 0000 5010 0200 P....3......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161628 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 125.57.21.195.592 > **.**.**.***.80: . [bad tcp cksum 5091 (->ff60)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 59b9 7d39 15c3 E..<....o.Y.}9..
    0x010: 4814 15f3 0250 0050 1234 5678 0000 0000 H....P.P.4Vx....
    0x020: 5010 0200 5091 0000 0000 0000 5010 0200 P...P.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161881 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 220.119.187.92.792 > **.**.**.***.80: . [bad tcp cksum 4af1 (->f9c0)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 53e1 dc77 bb5c E..<....p.S..w.\
    0x010: 4814 15f3 0318 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 4af1 0000 0000 0000 5010 0200 P...J.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161882 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 222.232.51.81.652 > **.**.**.***.80: . [bad tcp cksum d117 (->7fe7)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 da7b dee8 3351 E..<....o..{..3Q
    0x010: 4814 15f3 028c 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 d117 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.161998 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.527 > **.**.**.***.80: . [bad tcp cksum 3b58 (->816c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 020f 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3b58 0000 0000 0000 5010 0200 P...;X......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162001 IP (tos 0x0, ttl 114, id 62297, offset 0, flags [none], length: 60) 203.252.131.195.864 > **.**.**.***.80: . [bad tcp cksum 61fd (->418d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c f359 0000 7206 a79b cbfc 83c3 E..<.Y..r.......
    0x010: 4814 15f3 0360 0050 1234 5678 0000 0000 H....`.P.4Vx....
    0x020: 5010 0200 61fd 0000 0000 0000 5010 0200 P...a.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162124 IP (tos 0x0, ttl 117, id 256, offset 0, flags [none], length: 60) 58.87.128.138.707 > **.**.**.***.80: . [bad tcp cksum 63b0 (->d708)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7506 2bd4 3a57 808a E..<....u.+.:W..
    0x010: 4814 15f3 02c3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 63b0 0000 0000 0000 5010 0200 P...c.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162248 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.915 > **.**.**.***.80: . [bad tcp cksum 39d4 (->7fe8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0393 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 39d4 0000 0000 0000 5010 0200 P...9.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162250 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.422 > **.**.**.***.80: . [bad tcp cksum 3bc1 (->81d5)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 01a6 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3bc1 0000 0000 0000 5010 0200 P...;.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162264 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 121.147.49.175.289 > **.**.**.***.80: . [bad tcp cksum a215 (->e849)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 3f73 7993 31af E..<....q.?sy.1.
    0x010: 4814 15f3 0121 0050 1234 5678 0000 0000 H....!.P.4Vx....
    0x020: 5010 0200 a215 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162374 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 222.107.96.98.703 > **.**.**.***.80: . [bad tcp cksum c4b0 (->5320)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 aae7 de6b 6062 E..<....r....k`b
    0x010: 4814 15f3 02bf 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 c4b0 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162376 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 220.119.187.92.255 > **.**.**.***.80: . [bad tcp cksum 4d0a (->fbd9)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 53e1 dc77 bb5c E..<....p.S..w.\
    0x010: 4814 15f3 00ff 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 4d0a 0000 0000 0000 5010 0200 P...M.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162498 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 59.31.87.95.130 > **.**.**.***.80: . [bad tcp cksum bb78 (->1ad)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 5837 3b1f 575f E..<....q.X7;.W_
    0x010: 4814 15f3 0082 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 bb78 0000 0000 0000 5010 0200 P....x......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162623 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 210.118.224.125.292 > **.**.**.***.80: . [bad tcp cksum 6d3c (->e094)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 38c1 d276 e07d E..<....p.8..v.}
    0x010: 4814 15f3 0124 0050 1234 5678 0000 0000 H....$.P.4Vx....
    0x020: 5010 0200 6d3c 0000 0000 0000 5010 0200 P...m<......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162625 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 58.142.60.80.127 > **.**.**.***.80: . [bad tcp cksum b310 (->1d50)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 73d7 3a8e 3c50 E..<....q.s.:. 0x010: 4814 15f3 007f 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 b310 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162627 IP (tos 0x0, ttl 117, id 256, offset 0, flags [none], length: 60) 58.87.128.138.971 > **.**.**.***.80: . [bad tcp cksum 62a8 (->d600)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7506 2bd4 3a57 808a E..<....u.+.:W..
    0x010: 4814 15f3 03cb 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 62a8 0000 0000 0000 5010 0200 P...b.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162892 IP (tos 0x0, ttl 107, id 256, offset 0, flags [none], length: 60) 85.231.85.204.996 > **.**.**.***.80: . [bad tcp cksum 3666 (->e515)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6b06 4502 55e7 55cc E..<....k.E.U.U.
    0x010: 4814 15f3 03e4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3666 0000 0000 0000 5010 0200 P...6f......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162893 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.529 > **.**.**.***.80: . [bad tcp cksum 3b56 (->816a)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0211 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3b56 0000 0000 0000 5010 0200 P...;V......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162894 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.88 > **.**.**.***.80: . [bad tcp cksum 3d0f (->8323)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 0058 0050 1234 5678 0000 0000 H....X.P.4Vx....
    0x020: 5010 0200 3d0f 0000 0000 0000 5010 0200 P...=.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162896 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 86.106.186.199.979 > **.**.**.***.80: . [bad tcp cksum 3994 (->7fa8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 dc83 566a bac7 E..<....n...Vj..
    0x010: 4814 15f3 03d3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 3994 0000 0000 0000 5010 0200 P...9.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.162997 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 221.138.243.7.516 > **.**.**.***.80: . [bad tcp cksum 7be2 (->c216)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 1c23 dd8a f307 E..<....o..#....
    0x010: 4814 15f3 0204 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 7be2 0000 0000 0000 5010 0200 P...{.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    23:22:24.163122 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 58.77.117.83.369 > **.**.**.***.80: . [bad tcp cksum 9d67 (->e39b)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 3c15 3a4d 7553 E..<....p.<.:MuS
    0x010: 4814 15f3 0171 0050 1234 5678 0000 0000 H....q.P.4Vx....
    0x020: 5010 0200 9d67 0000 0000 0000 5010 0200 P....g......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............

    =========================

    DDoS Report Log
    Destination: **.**.**.***


    00:00:50.159938 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 222.118.28.63.611 > **.**.**.***.80: . [bad tcp cksum acbb (->9792)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 f1fd de76 1c3f E..<....o....v.?
    0x010: 4814 15f5 0263 0050 1234 5678 0000 0000 H....c.P.4Vx....
    0x020: 5010 0200 acbb 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160068 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.53.142.209.371 > **.**.**.***.80: . [bad tcp cksum 2a64 (->8831)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 e2ac 7c35 8ed1 E..<....n...|5..
    0x010: 4814 15f5 0173 0050 1234 5678 0000 0000 H....s.P.4Vx....
    0x020: 5010 0200 2a64 0000 0000 0000 5010 0200 P...*d......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160126 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.71 > **.**.**.***.80: . [bad tcp cksum 119b (->57cf)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 0047 0050 1234 5678 0000 0000 H....G.P.4Vx....
    0x020: 5010 0200 119b 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160165 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.547 > **.**.**.***.80: . [bad tcp cksum fbf (->55f3)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 0223 0050 1234 5678 0000 0000 H....#.P.4Vx....
    0x020: 5010 0200 0fbf 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160200 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.306 > **.**.**.***.80: . [bad tcp cksum 1788 (->5dbc)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0132 0050 1234 5678 0000 0000 H....2.P.4Vx....
    0x020: 5010 0200 1788 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160279 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.53.142.209.748 > **.**.**.***.80: . [bad tcp cksum 28eb (->86b8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 e2ac 7c35 8ed1 E..<....n...|5..
    0x010: 4814 15f5 02ec 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 28eb 0000 0000 0000 5010 0200 P...(.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160314 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 125.102.154.29.272 > **.**.**.***.80: . [bad tcp cksum 9150 (->7c17)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 d32f 7d66 9a1d E..<....q../}f..
    0x010: 4814 15f5 0110 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 9150 0000 0000 0000 5010 0200 P....P......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160402 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.582 >**.**.**.***.80: . [bad tcp cksum 1674 (->5ca8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0246 0050 1234 5678 0000 0000 H....F.P.4Vx....
    0x020: 5010 0200 1674 0000 0000 0000 5010 0200 P....t......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160433 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.593 > **.**.**.***.80: . [bad tcp cksum 1669 (->5c9d)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0251 0050 1234 5678 0000 0000 H....Q.P.4Vx....
    0x020: 5010 0200 1669 0000 0000 0000 5010 0200 P....i......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160466 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.309 > **.**.**.***.80: . [bad tcp cksum 1785 (->5db9)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0135 0050 1234 5678 0000 0000 H....5.P.4Vx....
    0x020: 5010 0200 1785 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160534 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.520 > **.**.**.***.80: . [bad tcp cksum 16b2 (->5ce6)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0208 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 16b2 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160562 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 124.53.83.53.824 > **.**.**.***.80: . [bad tcp cksum d731 (->c208)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 1c49 7c35 5335 E..<....p..I|5S5
    0x010: 4814 15f5 0338 0050 1234 5678 0000 0000 H....8.P.4Vx....
    0x020: 5010 0200 d731 0000 0000 0000 5010 0200 P....1......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160636 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 222.118.28.63.798 > **.**.**.***.80: . [bad tcp cksum ac00 (->96d7)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 f1fd de76 1c3f E..<....o....v.?
    0x010: 4814 15f5 031e 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 ac00 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160666 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.829 > **.**.**.***.80: . [bad tcp cksum ea5 (->54d9)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 033d 0050 1234 5678 0000 0000 H....=.P.4Vx....
    0x020: 5010 0200 0ea5 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160692 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.102 > **.**.**.***.80: . [bad tcp cksum 1854 (->5e88)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0066 0050 1234 5678 0000 0000 H....f.P.4Vx....
    0x020: 5010 0200 1854 0000 0000 0000 5010 0200 P....T......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160742 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 125.102.154.29.920 > **.**.**.***.80: . [bad tcp cksum 8ec8 (->798f)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 d32f 7d66 9a1d E..<....q../}f..
    0x010: 4814 15f5 0398 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 8ec8 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160771 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.176 > **.**.**.***.80: . [bad tcp cksum 1132 (->5766)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 00b0 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 1132 0000 0000 0000 5010 0200 P....2......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160799 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.678 > **.**.**.***.80: . [bad tcp cksum f3c (->5570)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 02a6 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 0f3c 0000 0000 0000 5010 0200 P....<......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160830 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 222.118.28.63.137 > **.**.**.***.80: . [bad tcp cksum ae95 (->996c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 f1fd de76 1c3f E..<....o....v.?
    0x010: 4814 15f5 0089 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 ae95 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160913 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.683 > **.**.**.***.80: . [bad tcp cksum f37 (->556b)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 02ab 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 0f37 0000 0000 0000 5010 0200 P....7......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160942 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.287 > **.**.**.***.80: . [bad tcp cksum 179b (->5dcf)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 011f 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 179b 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.160979 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.962 >**.**.**.***.80: . [bad tcp cksum 14f8 (->5b2c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 03c2 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 14f8 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161013 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 125.102.154.29.554 > **.**.**.***.80: . [bad tcp cksum 9036 (->7afd)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 d32f 7d66 9a1d E..<....q../}f..
    0x010: 4814 15f5 022a 0050 1234 5678 0000 0000 H....*.P.4Vx....
    0x020: 5010 0200 9036 0000 0000 0000 5010 0200 P....6......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161043 IP (tos 0x0, ttl 112, id 256, offset 0, flags [none], length: 60) 124.53.83.53.468 > **.**.**.***.80: . [bad tcp cksum d895 (->c36c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7006 1c49 7c35 5335 E..<....p..I|5S5
    0x010: 4814 15f5 01d4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 d895 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161077 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.947 > **.**.**.***.80: . [bad tcp cksum 1507 (->5b3b)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 03b3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 1507 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161126 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.862 > **.**.**.***.80: . [bad tcp cksum e84 (->54b8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 035e 0050 1234 5678 0000 0000 H....^.P.4Vx....
    0x020: 5010 0200 0e84 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161156 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 62.234.25.34.733 > **.**.**.***.80: . [bad tcp cksum 8b12 (->39c2)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 92a7 3eea 1922 E..<....q...>.."
    0x010: 4814 15f5 02dd 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 8b12 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161193 IP (tos 0x0, ttl 116, id 256, offset 0, flags [none], length: 60) 82.234.23.118.307 > **.**.**.***.80: . [bad tcp cksum e303 (->2918)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7406 7d53 52ea 1776 E..<....t.}SR..v
    0x010: 4814 15f5 0133 0050 1234 5678 0000 0000 H....3.P.4Vx....
    0x020: 5010 0200 e303 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161238 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.53.142.209.951 > **.**.**.***.80: . [bad tcp cksum 2820 (->85ed)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 e2ac 7c35 8ed1 E..<....n...|5..
    0x010: 4814 15f5 03b7 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 2820 0000 0000 0000 5010 0200 P...(.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161267 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.53.142.209.305 > **.**.**.***: . [bad tcp cksum 2aa6 (->8873)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 e2ac 7c35 8ed1 E..<....n...|5..
    0x010: 4814 15f5 0131 0050 1234 5678 0000 0000 H....1.P.4Vx....
    0x020: 5010 0200 2aa6 0000 0000 0000 5010 0200 P...*.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161294 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 62.234.25.34.574 > **.**.**.***.80: . [bad tcp cksum 8bb1 (->3a61)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 92a7 3eea 1922 E..<....q...>.."
    0x010: 4814 15f5 023e 0050 1234 5678 0000 0000 H....>.P.4Vx....
    0x020: 5010 0200 8bb1 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161320 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.53.142.209.468 >**.**.**.***.80: . [bad tcp cksum 2a03 (->87d0)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 e2ac 7c35 8ed1 E..<....n...|5..
    0x010: 4814 15f5 01d4 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 2a03 0000 0000 0000 5010 0200 P...*.......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161398 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 62.234.25.34.1005 > **.**.**.***.80: . [bad tcp cksum 8a02 (->38b2)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 92a7 3eea 1922 E..<....q...>.."
    0x010: 4814 15f5 03ed 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 8a02 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161428 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 125.102.154.29.691 > **.**.**.***.80: . [bad tcp cksum 8fad (->7a74)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 d32f 7d66 9a1d E..<....q../}f..
    0x010: 4814 15f5 02b3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 8fad 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161455 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.218 > **.**.**.***.80: . [bad tcp cksum 1108 (->573c)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 00da 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 1108 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161511 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.560 > **.**.**.***.80: . [bad tcp cksum fb2 (->55e6)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 0230 0050 1234 5678 0000 0000 H....0.P.4Vx....
    0x020: 5010 0200 0fb2 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161544 IP (tos 0x0, ttl 113, id 256, offset 0, flags [none], length: 60) 125.102.154.29.79 > **.**.**.***.80: . [bad tcp cksum 9211 (->7cd8)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7106 d32f 7d66 9a1d E..<....q../}f..
    0x010: 4814 15f5 004f 0050 1234 5678 0000 0000 H....O.P.4Vx....
    0x020: 5010 0200 9211 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161574 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.578 > **.**.**.***.80: . [bad tcp cksum 1678 (->5cac)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 0242 0050 1234 5678 0000 0000 H....B.P.4Vx....
    0x020: 5010 0200 1678 0000 0000 0000 5010 0200 P....x......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161670 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 220.83.89.105.381 > **.**.**.***.80: . [bad tcp cksum 173d (->5d71)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 b6f6 dc53 5969 E..<....o....SYi
    0x010: 4814 15f5 017d 0050 1234 5678 0000 0000 H....}.P.4Vx....
    0x020: 5010 0200 173d 0000 0000 0000 5010 0200 P....=......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161698 IP (tos 0x0, ttl 114, id 256, offset 0, flags [none], length: 60) 82.234.23.118.995 > **.**.**.***.80: . [bad tcp cksum e053 (->2668)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 7206 7f53 52ea 1776 E..<....r..SR..v
    0x010: 4814 15f5 03e3 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 e053 0000 0000 0000 5010 0200 P....S......P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161758 IP (tos 0x0, ttl 111, id 256, offset 0, flags [none], length: 60) 222.118.28.63.288 > **.**.**.***.80: . [bad tcp cksum adfe (->98d5)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6f06 f1fd de76 1c3f E..<....o....v.?
    0x010: 4814 15f5 0120 0050 1234 5678 0000 0000 H......P.4Vx....
    0x020: 5010 0200 adfe 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161787 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.809 > **.**.**.***.80: . [bad tcp cksum eb9 (->54ed)!] 305419896:305419916(20) ack 0 win 512
    0x000: 4500 003c 0100 0000 6e06 b11e 7c32 c062 E..<....n...|2.b
    0x010: 4814 15f5 0329 0050 1234 5678 0000 0000 H....).P.4Vx....
    0x020: 5010 0200 0eb9 0000 0000 0000 5010 0200 P...........P...
    0x030: 0000 0000 0000 0000 0000 0000 ............
    00:00:50.161814 IP (tos 0x0, ttl 110, id 256, offset 0, flags [none], length: 60) 124.50.192.98.698 > **.**.**.***.80: . [bad tcp cksum f28 (->555c)!] 305419896:3054
    Last edited by SoftWareRevue; 10-08-2006 at 01:16 PM.

  2. #2
    Join Date
    Dec 2004
    Location
    New York, NY
    Posts
    10,574
    Have you contacted Staminus? They should be able to assist with setting up a firewall rule to help filter your attack. Show them the logs you pasted in this thread.

  3. #3
    Join Date
    Sep 2004
    Posts
    40
    Toro Told me I have to pay $1000 each month to filter this kind of attack and my server is down and he told me we have to wait until they Stop.

  4. #4
    Until it stops, what about trying this:

    I believe you have your forum at http://www.example.com - if so, setup the DNS-service for http://www.example.com to point to 127.0.0.1 or similar.

    Then, create subdomain http://forum.example.com and point DNS for this subdomain to the servers IP-adress, now mail your members and tell them about the DOS and give them the new adress.

    If the attacks continue after DNS change is updated, you may suppose that they are attacking directly to your IP-adress, if so the solution may be to request Staminus to change your IP-adress?

  5. #5
    Join Date
    Jul 2004
    Location
    Athens, Greece
    Posts
    203
    alamazoni, in case of web-based attacks, seperating valid web traffic from invalid one is pretty tricky at times since botnets are being used to simulate normal web visitors by fetching webpages like a normal visitor would do. Filtering such attack is possible but indeed it requires extra processing to filter it, which is probably why you were requested to pay extra.

    However, according to the logs you provided, the packets you're receiving seem to be spoofed (noticed the "bad tcp cksum" on every single packet?) which helps seperating them from normal traffic and that might also help you and your provider on having them filtered.

    Thank you.

    PS: You probably have forgotten to wildcard the IPs on the last log. Since you didn't want to publicize your IPs in first place, you may contact WHT moderators and request them to let you edit your message or auto-replace <IP> with *.*.*.* as you did on your previous logs.

    EDIT:

    Michael, even though you got a point, in most cases it wouldn't work. Forums usually get attacked from a pissed off member (someone who's thread/post got removed or he disagreed with a mod's thoughts). So unless that member is completely banned and has no multiple accounts, he'll receive the new IP information as well and he'll be able to redirect the attack to the new IP too.
    Last edited by psyxakias; 10-08-2006 at 10:49 AM.
    SharkTECH Internet Services
    http://www.sharktech.net
    DDOS Firewalled Dedicated Servers
    Managed Services / IRC Allowed

  6. #6
    #5 Well, with the alternative to be doing nothing, I belive it was worth a try However, other advices may be more helpful

  7. #7
    Join Date
    Mar 2006
    Location
    New York USA
    Posts
    402
    heh yeah, seems to be a massive botnet (spoofed attack) along with Flags[none]. You should be able to filter this easily.

  8. #8
    Join Date
    Feb 2004
    Location
    here and there
    Posts
    746
    ACK packets for the win.

    Awknet - DDoS Mitigation, Upstream ACLs/Filtering, Unmanaged Dedicated Servers, BGP IP Transit & More!

  9. #9
    You can write a small perl script and collect ip addresses, which attack you. Upon that, a custom trick on a software firewall can help. Alternatively, you can start 2 virtual machines on the same node and limit resources (one as a firewall and the second as a frontend server). However it all depends on a hardware, cause it will take quite a lot of resources.

  10. #10
    Join Date
    Jul 2004
    Location
    Athens, Greece
    Posts
    203
    lwh4sale, collecting srcIP addresses during a spoofed attack is kinda pointless though.
    SharkTECH Internet Services
    http://www.sharktech.net
    DDOS Firewalled Dedicated Servers
    Managed Services / IRC Allowed

  11. #11
    Join Date
    Apr 2002
    Location
    Wirral/Cheshire/Meresyside
    Posts
    203
    www.plantiumservermanagement.com get them to help they seem pretty good
    http://www.gocre8.co.uk - Liverpool Web Design
    http://www.outallnite.co.uk - Liverpool Clubbing

  12. #12
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    We get these attacks daily at ECSPortal.com but normally the simplest way is to use the firewall settings at Staminus to block out attacks. One thing you can do is login at Staminus set your firewall to block all traffic on port 80 incoming to your box then login with SSH. Find the IP Addresses coming in and block them all. Then come back and turn the rate of traffic down to like 64k with the Staminus firewall. Slowly let traffic back in and keep banning addresses.

    If you have Dos Deflate - Mod Evasive - APF running then they should block them all but the cron jobs are probably so backed up they arent running.

    Hope this helps.

    Just so you know this process works:
    [[email protected] ~]# w
    11:18:54 up 37 days, 12:02, 1 user, load average: 0.13, 0.26, 0.30
    USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
    root pts/0 adsl-072-148-015 11:18 0.00s 0.02s 0.00s w

    -------------------
    Here is our log
    -------------------
    Recent Attacks: Attack Destination:
    Start Time: [Fri Sep 8 17:04:44 2006]
    End Time: [Fri Sep 8 17:05:12 2006]
    Rate: 129,398 Packets Per Second

    Attack Destination:
    Start Time: [Fri Sep 8 19:55:44 2006]
    End Time: [Fri Sep 8 19:58:12 2006]
    Rate: 605,799 KiloBits Per Second

    Attack Destination:
    Start Time: [Fri Sep 8 22:45:16 2006]
    End Time: [Fri Sep 8 22:45:24 2006]
    Rate: 291,527 Packets Per Second

    Attack Destination:
    Start Time: [Sat Sep 9 09:05:48 2006]
    End Time: [Sat Sep 9 09:07:40 2006]
    Rate: 78,838 Packets Per Second

    Attack Destination:
    Start Time: [Sat Sep 9 12:40:52 2006]
    End Time: [Sat Sep 9 12:50:16 2006]
    Rate: 461,661 KiloBits Per Second

    Attack Destination:
    Start Time: [Sat Sep 9 13:14:52 2006]
    End Time: [Sat Sep 9 13:15:04 2006]
    Rate: 168,421 Packets Per Second

    Attack Destination:
    Start Time: [Sat Sep 9 16:04:08 2006]
    End Time: [Sat Sep 9 16:07:44 2006]
    Rate: 309,678 KiloBits Per Second

    Attack Destination:
    Start Time: [Sun Sep 10 15:00:24 2006]
    End Time: [Sun Sep 10 15:12:08 2006]
    Rate: 235,262 KiloBits Per Second

    Attack Destination:
    Start Time: [Tue Sep 12 00:53:24 2006]
    End Time: [Tue Sep 12 00:59:16 2006]
    Rate: 267,812 KiloBits Per Second

    Attack Destination:
    Start Time: [Tue Sep 12 17:34:40 2006]
    End Time: [Tue Sep 12 17:41:12 2006]
    Rate: 208,205 KiloBits Per Second

    Attack Destination:
    Start Time: [Wed Sep 13 23:01:16 2006]
    End Time: [Wed Sep 13 23:03:44 2006]
    Rate: 42,141 KiloBits Per Second

    Attack Destination:
    Start Time: [Sat Sep 16 17:02:48 2006]
    End Time: [Sat Sep 16 17:19:28 2006]
    Rate: 21,453 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 18 10:36:48 2006]
    End Time: [Mon Sep 18 10:37:04 2006]
    Rate: 2,892,642 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 18 10:37:00 2006]
    End Time: [Mon Sep 18 10:37:08 2006]
    Rate: 2,015,486 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 18 15:30:48 2006]
    End Time: [Mon Sep 18 15:31:00 2006]
    Rate: 3,102,234 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 18 15:31:20 2006]
    End Time: [Mon Sep 18 15:31:32 2006]
    Rate: 3,291,081 KiloBits Per Second

    Attack Destination:
    Start Time: [Tue Sep 19 05:37:44 2006]
    End Time: [Tue Sep 19 07:14:08 2006]
    Rate: 125,883 KiloBits Per Second

    Attack Destination:
    Start Time: [Fri Sep 22 03:59:20 2006]
    End Time: [Fri Sep 22 04:00:16 2006]
    Rate: 170,353 KiloBits Per Second

    Attack Destination:
    Start Time: [Fri Sep 22 11:55:32 2006]
    End Time: [Fri Sep 22 11:55:36 2006]
    Rate: 122,144 KiloBits Per Second

    Attack Destination:
    Start Time: [Sun Sep 24 16:06:52 2006]
    End Time: [Sun Sep 24 16:07:00 2006]
    Rate: 3,673,736 KiloBits Per Second

    Attack Destination:
    Start Time: [Sun Sep 24 16:07:56 2006]
    End Time: [Sun Sep 24 16:08:04 2006]
    Rate: 1,541,587 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 09:09:40 2006]
    End Time: [Mon Sep 25 09:09:40 2006]
    Rate: 45,334 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 10:46:32 2006]
    End Time: [Mon Sep 25 10:46:40 2006]
    Rate: 290,709 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 15:14:12 2006]
    End Time: [Mon Sep 25 15:14:28 2006]
    Rate: 1,619,860 Packets Per Second

    Attack Destination:
    Start Time: [Mon Sep 25 15:15:12 2006]
    End Time: [Mon Sep 25 15:15:24 2006]
    Rate: 1,860,494 Packets Per Second

    Attack Destination:
    Start Time: [Wed Sep 27 10:41:21 2006]
    End Time: [Wed Sep 27 10:42:25 2006]
    Rate: 2,398,488 KiloBits Per Second

    Attack Destination:
    Start Time: [Wed Sep 27 10:41:25 2006]
    End Time: [Wed Sep 27 10:42:17 2006]
    Rate: 2,895,830 KiloBits Per Second

    Attack Destination:
    Start Time: [Thu Sep 28 01:44:29 2006]
    End Time: [Thu Sep 28 01:44:29 2006]
    Rate: 49,674 KiloBits Per Second

    Attack Destination:
    Start Time: [Thu Sep 28 05:22:53 2006]
    End Time: [Thu Sep 28 05:22:57 2006]
    Rate: 36,664 KiloBits Per Second

    Attack Destination:
    Start Time: [Thu Sep 28 07:14:25 2006]
    End Time: [Thu Sep 28 07:14:29 2006]
    Rate: 122,125 KiloBits Per Second

    Attack Destination:
    Start Time: [Sun Oct 1 05:07:33 2006]
    End Time: [Sun Oct 1 05:07:33 2006]
    Rate: 30,745 KiloBits Per Second

    Attack Destination:
    Start Time: [Mon Oct 2 03:52:33 2006]
    End Time: [Mon Oct 2 03:52:37 2006]
    Rate: 135,314 KiloBits Per Second

    Attack Destination:
    Start Time: [Sat Oct 7 16:54:37 2006]
    End Time: [Sat Oct 7 17:06:41 2006]
    Rate: 27,174 KiloBits Per Second

    Attack Destination:
    Start Time: [Sun Oct 8 09:15:59 2006]
    End Time: [Sun Oct 8 09:32:47 2006]
    Rate: 645,551 KiloBits Per Second
    Last edited by FiberPeer; 10-09-2006 at 02:24 PM.
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  13. #13
    Join Date
    Mar 2005
    Location
    Maine, USA
    Posts
    302
    These DDoS attacks never cease to amaze me. That amount of data being pushed in that length of time.

  14. #14
    Join Date
    Mar 2005
    Posts
    90
    You should give Sharktech.net a try, psyxakias above filtered out similar attack for me in no time at no extra charge.

  15. #15
    Join Date
    Feb 2003
    Location
    North Hollywood, CA
    Posts
    2,554
    How to stop-

    login to cisco switch
    config t
    int fa 0/x
    shut
    exit
    write mem
    close putty


    But really i hate ddosr's...
    Remote Hands and Your Local Tech for the Los Angeles area.

    (310) 573-8050 - LinkedIn

  16. #16
    Join Date
    Aug 2004
    Location
    USA
    Posts
    240
    serverorigin don't want to disagree with you, but we had customers receiving HTTP DDOS attack from few thousand IPs at the same time. Something like you mentioned is hard and almost impossible to acheive manually.

    I wish I can give more details on the mechanism we use to filter out these attacks, but yes decreasing the effect of the attack can start with limiting SYN sessions to your server with something no more than 32Kbps (SYN is only the initial TCP session attempt and will not effect established sessions). Also limit source address to something practical maybe limit of 4 SYN sessions per IP.

    Some tweaking on your httpd would also help. You can also look into your TCP configuration and lower down the lifetime of a syn open session. This will also help so your system wont keep too many half-open sessions.

    Their are many articles around good ways to strengthening your server against HTTP attacks spending some time reading wont be a waste of time
    Tim Timrawi
    Founder, Sharktech
    https://sharktech.net
    Sharktech provides secure cyberspace with unique in-line and cloud-based DDoS protection.

  17. #17
    Join Date
    May 2006
    Posts
    1,398
    geez, so staminus has ddos protection but it will cost you $1000 a month to stop a spoofed packet attack?
    You gotta be kidding me.
    My friend who I share a server for ircs with had one of those extra charge deals with staminus. Our server is on a 10 mb line but supposedly we overaged our bandwidth of 1200gb in 2 weeks when we did not notice anything in the server we just all a sudden got cut off and had to pay a fee, like over $100 to get it turned back on. So they had to have charged us for ddos bandwidth that did not even reach the server.
    That is the only problem we had with them however, My friend whos account this is all in chose not to fight it because he said it would do no good.
    Staminus seems pretty good overall but this thread here doesnt look too good.

    Try sharktech

  18. #18
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    Should probably get in enable mode

    Quote Originally Posted by Jeremy
    How to stop-

    login to cisco switch
    config t
    int fa 0/x
    shut
    exit
    write mem
    close putty


    But really i hate ddosr's...
    And for the comment on Staminus wanting to charge 1000.00 to filter this, I am not quite sure we are getting the full story on that. I would kind of like to see Matt comment on this.


    Jigy: I didn't say manually. I just said of what Dos Deflate/APF doesn't pick up. If you kill the connections coming to the server for a moment and let the cron jobs run, normally they will filter it. Just whatever doesn't get filtered quick enough, manually do it. And I am guessing you can contest that this wasn't dozens of IP's hitting my servers?

    But I can assure anyone on this forum there is no comparison when it comes to Staminus or Gigeservers.
    Last edited by FiberPeer; 10-12-2006 at 04:47 AM.
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

  19. #19
    Join Date
    Feb 2004
    Location
    here and there
    Posts
    746
    From what I've been told by other customers....

    Staminus and Gige both offer "deep inspection" labelled services for HTTP attack customers in the $1,000/mo range. BLCC (black lotus) resells this same service from staminus in the $400-500 range, it seems.

    From usernames and the description of the problem I think we've actually started working with Abdo, so, lets see I guess we'll findout if our approach to the problem fixes it up for him...

    Abdo... apparently I should be charging way more for your setup hehe.

    Awknet - DDoS Mitigation, Upstream ACLs/Filtering, Unmanaged Dedicated Servers, BGP IP Transit & More!

  20. #20
    Join Date
    Jun 2006
    Location
    NYC
    Posts
    1,446
    And I must correct myself. Awknet -- I am unsure of their setup as I have never used them but I have heard good things in the IRC side of things from people who have used them. If I were looking, I would consider their services as well.
    FiberPeer.Com | | REAL DDoS Protection | Cloud Hosting | VPS | Dedicated Servers | High Bandwidth Hosting | 1Gbps-10Gbps Unmetered
    FiberPeer DDoS Mitigation | ethProxy Upgraded! | 14-Years Experience | Emergency 24/7 Support
    Visit us @ www.fiberpeer.com

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •