Question about UDP flooding

=?iso-2022-kr?Q?Jongwon_Kim=28=D1=D1_=F1=A3=EA=AA=29?= knight at streamwk.kix.net
Tue Dec 7 02:49:10 UTC 1999


Hi! Everyone.
This is Jongwon Kim from Korea Telecom in seoul ,KOREA.
We have a severe udp flooding form our server as follow.

.Dec  7 10:53:15: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43307) -> x.x.x.x(50753), 1 packet
.Dec  7 10:53:16: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43422) -> x.x.x.x(42084), 1 packet
.Dec  7 10:53:17: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43539) -> x.x.x.x(47889), 1 packet
.Dec  7 10:53:18: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43656) -> x.x.x.x(48642), 1 packet
.Dec  7 10:53:19: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43773) -> x.x.x.x(60407), 1 packet
.Dec  7 10:53:20: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(43890) -> x.x.x.x(48339), 1 packet
.Dec  7 10:53:21: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(44001) -> x.x.x.x(56690), 1 packet
.Dec  7 10:53:22: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(44117) -> x.x.x.x(18638), 1 packet
.Dec  7 10:53:23: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(44234) -> x.x.x.x(12099), 1 packet
.Dec  7 10:53:24: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(44350) -> x.x.x.x(18927), 1 packet
.Dec  7 10:53:25: %SEC-6-IPACCESSLOGP: list 102 permitted udp 203.234.254.1(44467) -> x.x.x.x(61352), 1 packet

We'd like to know how do i limit the udp port use above 40,000 in the host .

Any comment will be appreciated .

TIA



 -*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
       KORNET Network Assistance Manager(Centural O&M Center)
         - Voice : 82-2-766-5902  -Fax : 82-2-766-5901
                   -E-Mail : knight at kix.net
 ====================================================================






More information about the NANOG mailing list