Here is my suggestion to you friend: Your server has too many services running there. You can either add a firewall or disable no useful services ... -bugfree(BugFree) @拉斯维加斯华人论坛:拉斯维加斯枫下论坛 The Rolia Forum of Las Vegas

工作学习 / 专业技术讨论 / 请教高手, 如何对付网络攻击. -randomwalk(*%_%*); 2005-10-29 {175} (#2578948@0)
我一朋友的游戏网站最近老受攻击, 在2-3分钟里，他们的上传和下载都是将近4Mbs，网络很堵，游戏中的人很大一部分都被挤掉线了. 怎么知道是谁, 用什么方法攻击的, 应该如何对付?

多谢！

用一些软件象netstat察看谁访问机器，如果能确定攻击者，用防火墙拒绝它的访问。 -holdon(again); 2005-10-29 (#2579138@0)
"网络攻击"? what kind of? DDOS or normal. Firewall can help you in some way. I can give you more solution when you give more information. -bugfree(BugFree); 2005-10-29 (#2580034@0)

具体我也搞不懂,但是有netstat output. -randomwalk(*%_%*); 2005-10-29 {34208} (#2580133@0)
本文发表在 rolia.net 枫下论坛This is what I got from the netstat. The 2nd netstat output shows that there were a lot of time_wait. After that, most of the connections were lost.

Could you please take a look? If you need more information, please let me know. Thanks a lot!

D:\temp>time /T
18:04

D:\temp>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:26 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1300
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING 964
TCP 0.0.0.0:1032 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1033 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1034 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING 3432
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 780
TCP 0.0.0.0:7000 0.0.0.0:0 LISTENING 3232
TCP 0.0.0.0:7100 0.0.0.0:0 LISTENING 3848
TCP 0.0.0.0:7200 0.0.0.0:0 LISTENING 2712
TCP 0.0.0.0:7210 0.0.0.0:0 LISTENING 2924
TCP 0.0.0.0:7220 0.0.0.0:0 LISTENING 3252
TCP 0.0.0.0:7600 0.0.0.0:0 LISTENING 2624
TCP 0.0.0.0:63000 0.0.0.0:0 LISTENING 1668
TCP 61.128.194.170:63000 61.128.194.170:1068 CLOSE_WAIT 1668
TCP 54.64.27.66:3389 65.94.60.172:63175 ESTABLISHED 780
TCP 54.64.27.66:7000 69.193.130.232:1107 FIN_WAIT_2 3232
TCP 54.64.27.66:7000 70.25.53.43:3150 ESTABLISHED 3232
TCP 54.64.27.66:7000 82.25.46.130:1317 ESTABLISHED 3232
TCP 54.64.27.66:7000 84.99.211.97:35914 ESTABLISHED 3232
TCP 54.64.27.66:7000 156.34.165.41:1475 ESTABLISHED 3232
TCP 54.64.27.66:7000 210.221.74.59:1376 ESTABLISHED 3232
TCP 54.64.27.66:7000 213.224.120.43:4299 ESTABLISHED 3232
TCP 54.64.27.66:7200 60.229.211.10:1598 ESTABLISHED 2712
TCP 54.64.27.66:7200 60.229.211.10:2917 ESTABLISHED 2712
TCP 54.64.27.66:7200 60.229.211.10:3395 ESTABLISHED 2712
TCP 54.64.27.66:7200 60.229.211.10:3734 ESTABLISHED 2712
TCP 54.64.27.66:7200 62.35.240.2:4500 ESTABLISHED 2712
TCP 54.64.27.66:7200 62.35.240.2:4514 ESTABLISHED 2712
TCP 54.64.27.66:7200 62.254.133.247:33103 ESTABLISHED 2712
TCP 54.64.27.66:7200 67.189.175.214:62664 ESTABLISHED 2712
TCP 54.64.27.66:7200 68.51.37.76:2702 ESTABLISHED 2712
TCP 54.64.27.66:7200 68.63.135.119:38067 ESTABLISHED 2712
TCP 54.64.27.66:7200 69.104.90.179:3015 ESTABLISHED 2712
TCP 54.64.27.66:7200 69.193.130.232:1110 ESTABLISHED 2712
TCP 54.64.27.66:7200 71.140.202.9:30552 ESTABLISHED 2712
TCP 54.64.27.66:7200 81.39.128.78:17676 ESTABLISHED 2712
TCP 54.64.27.66:7200 82.25.46.130:1320 ESTABLISHED 2712
TCP 54.64.27.66:7200 82.57.44.110:4701 ESTABLISHED 2712
TCP 54.64.27.66:7200 82.88.99.110:2226 ESTABLISHED 2712
TCP 54.64.27.66:7200 83.25.8.111:2312 ESTABLISHED 2712
TCP 54.64.27.66:7200 83.41.66.71:28331 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.97.27.185:1177 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.97.27.185:1186 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.97.27.185:1198 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.112.93.232:62051 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.112.93.232:62183 ESTABLISHED 2712
TCP 54.64.27.66:7200 84.130.134.152:1268 ESTABLISHED 2712
TCP 54.64.27.66:7200 86.133.83.137:62557 ESTABLISHED 2712
TCP 54.64.27.66:7200 154.20.81.33:33063 ESTABLISHED 2712
TCP 54.64.27.66:7200 203.122.115.135:51019 ESTABLISHED 2712
TCP 54.64.27.66:7200 205.251.120.150:50380 ESTABLISHED 2712
TCP 54.64.27.66:7200 212.139.35.155:2497 ESTABLISHED 2712
TCP 54.64.27.66:7200 212.139.35.155:2551 ESTABLISHED 2712
TCP 54.64.27.66:7200 213.224.120.43:4081 ESTABLISHED 2712
TCP 54.64.27.66:7210 62.101.126.208:34791 ESTABLISHED 2924
TCP 54.64.27.66:7210 68.10.213.201:1865 ESTABLISHED 2924
TCP 54.64.27.66:7210 68.51.37.76:2728 ESTABLISHED 2924
TCP 54.64.27.66:7210 68.145.110.205:1043 ESTABLISHED 2924
TCP 54.64.27.66:7210 68.145.110.205:1079 ESTABLISHED 2924
TCP 54.64.27.66:7210 69.86.167.40:1046 ESTABLISHED 2924
TCP 54.64.27.66:7210 69.104.90.179:3028 ESTABLISHED 2924
TCP 54.64.27.66:7210 69.104.90.179:4313 ESTABLISHED 2924
TCP 54.64.27.66:7210 69.104.90.179:4542 ESTABLISHED 2924
TCP 54.64.27.66:7210 69.193.130.232:1115 ESTABLISHED 2924
TCP 54.64.27.66:7210 70.25.53.43:3003 ESTABLISHED 2924
TCP 54.64.27.66:7210 81.100.172.37:1402 ESTABLISHED 2924
TCP 54.64.27.66:7210 81.208.36.89:55460 ESTABLISHED 2924
TCP 54.64.27.66:7210 82.32.210.182:1625 ESTABLISHED 2924
TCP 54.64.27.66:7210 82.53.35.236:3077 ESTABLISHED 2924
TCP 54.64.27.66:7210 83.114.179.234:4801 ESTABLISHED 2924
TCP 54.64.27.66:7210 84.99.211.97:35109 ESTABLISHED 2924
TCP 54.64.27.66:7210 84.99.211.97:35174 ESTABLISHED 2924
TCP 54.64.27.66:7210 84.112.93.232:62153 ESTABLISHED 2924
TCP 54.64.27.66:7210 84.112.93.232:62219 ESTABLISHED 2924
TCP 54.64.27.66:7210 86.132.101.6:2928 ESTABLISHED 2924
TCP 54.64.27.66:7210 86.133.83.137:1553 ESTABLISHED 2924
TCP 54.64.27.66:7210 144.131.196.91:61853 ESTABLISHED 2924
TCP 54.64.27.66:7210 149.167.122.39:3896 ESTABLISHED 2924
TCP 54.64.27.66:7210 149.167.122.39:3971 ESTABLISHED 2924
TCP 54.64.27.66:7210 203.79.103.148:1640 ESTABLISHED 2924
TCP 54.64.27.66:7210 212.139.35.155:2491 ESTABLISHED 2924
TCP 54.64.27.66:7210 212.194.239.225:1225 ESTABLISHED 2924
TCP 54.64.27.66:7220 24.81.194.29:61532 ESTABLISHED 3252
TCP 54.64.27.66:7220 24.253.197.142:3562 ESTABLISHED 3252
TCP 54.64.27.66:7220 24.253.197.142:3649 ESTABLISHED 3252
TCP 54.64.27.66:7220 60.229.211.10:1594 ESTABLISHED 3252
TCP 54.64.27.66:7220 60.229.211.10:2932 ESTABLISHED 3252
TCP 54.64.27.66:7220 60.229.211.10:2943 ESTABLISHED 3252
TCP 54.64.27.66:7220 62.35.240.2:2218 ESTABLISHED 3252
TCP 54.64.27.66:7220 65.92.159.96:61857 ESTABLISHED 3252
TCP 54.64.27.66:7220 68.51.37.76:2704 ESTABLISHED 3252
TCP 54.64.27.66:7220 68.63.135.119:1442 ESTABLISHED 3252
TCP 54.64.27.66:7220 68.63.135.119:3681 ESTABLISHED 3252
TCP 54.64.27.66:7220 68.83.65.174:3940 ESTABLISHED 3252
TCP 54.64.27.66:7220 68.145.110.205:2068 ESTABLISHED 3252
TCP 54.64.27.66:7220 69.192.3.34:1786 ESTABLISHED 3252
TCP 54.64.27.66:7220 70.51.122.82:2036 ESTABLISHED 3252
TCP 54.64.27.66:7220 80.227.165.45:3242 ESTABLISHED 3252
TCP 54.64.27.66:7220 81.208.106.72:19227 ESTABLISHED 3252
TCP 54.64.27.66:7220 81.208.106.72:24944 ESTABLISHED 3252
TCP 54.64.27.66:7220 83.89.57.234:3951 ESTABLISHED 3252
TCP 54.64.27.66:7220 84.97.27.185:1171 ESTABLISHED 3252
TCP 54.64.27.66:7220 84.112.93.232:62071 ESTABLISHED 3252
TCP 54.64.27.66:7220 84.112.93.232:62154 ESTABLISHED 3252
TCP 54.64.27.66:7220 84.130.134.152:1530 ESTABLISHED 3252
TCP 54.64.27.66:7220 142.162.34.75:61545 ESTABLISHED 3252
TCP 54.64.27.66:7220 149.167.122.39:3927 ESTABLISHED 3252
TCP 54.64.27.66:7220 151.202.106.189:50304 ESTABLISHED 3252
TCP 54.64.27.66:7220 203.79.103.148:1627 ESTABLISHED 3252
TCP 54.64.27.66:7220 213.140.22.64:24198 ESTABLISHED 3252
TCP 54.64.27.66:7220 213.224.120.43:2271 ESTABLISHED 3252
TCP 127.0.0.1:1035 0.0.0.0:0 LISTENING 1412
TCP 127.0.0.1:1040 127.0.0.1:5500 ESTABLISHED 3232
TCP 127.0.0.1:1041 127.0.0.1:5100 ESTABLISHED 3848
TCP 127.0.0.1:1043 127.0.0.1:5600 ESTABLISHED 3012
TCP 127.0.0.1:1044 127.0.0.1:5600 ESTABLISHED 132
TCP 127.0.0.1:1072 127.0.0.1:6000 ESTABLISHED 132
TCP 127.0.0.1:1299 127.0.0.1:5000 SYN_SENT 3252
TCP 127.0.0.1:1300 127.0.0.1:5000 SYN_SENT 2924
TCP 127.0.0.1:1301 127.0.0.1:5000 SYN_SENT 2712
TCP 127.0.0.1:4900 0.0.0.0:0 LISTENING 132
TCP 127.0.0.1:5000 127.0.0.1:1071 TIME_WAIT 0
TCP 127.0.0.1:5100 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:5100 127.0.0.1:1041 ESTABLISHED 3012
TCP 127.0.0.1:5500 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5500 127.0.0.1:1040 ESTABLISHED 3432
TCP 127.0.0.1:5600 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5600 127.0.0.1:1043 ESTABLISHED 3432
TCP 127.0.0.1:5600 127.0.0.1:1044 ESTABLISHED 3432
TCP 127.0.0.1:6000 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:6000 127.0.0.1:1072 ESTABLISHED 3012
TCP 127.0.0.1:43958 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.177:139 0.0.0.0:0 LISTENING 4
TCP 206.51.230.177:3389 86.132.101.6:1071 ESTABLISHED 780
TCP 206.51.230.254:21 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.254:21 69.156.60.183:2219 ESTABLISHED 2776
TCP 206.51.230.254:1298 0.0.0.0:0 LISTENING 2776
UDP 0.0.0.0:161 *:* 748
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 964
UDP 0.0.0.0:1026 *:* 276
UDP 0.0.0.0:1030 *:* 748
UDP 0.0.0.0:1037 *:* 1400
UDP 0.0.0.0:1042 *:* 132
UDP 0.0.0.0:3456 *:* 588
UDP 0.0.0.0:4500 *:* 964
UDP 0.0.0.0:10000 *:* 3620
UDP 61.128.194.170:53 *:* 276
UDP 61.128.194.170:123 *:* 1424
UDP 54.64.27.66:53 *:* 276
UDP 54.64.27.66:123 *:* 1424
UDP 127.0.0.1:53 *:* 276
UDP 127.0.0.1:123 *:* 1424
UDP 127.0.0.1:1025 *:* 276
UDP 127.0.0.1:3456 *:* 588
UDP 206.51.230.177:53 *:* 276
UDP 206.51.230.177:123 *:* 1424
UDP 206.51.230.177:137 *:* 4
UDP 206.51.230.177:138 *:* 4
UDP 206.51.230.178:53 *:* 276
UDP 206.51.230.178:123 *:* 1424
UDP 206.51.230.179:53 *:* 276
UDP 206.51.230.179:123 *:* 1424
UDP 206.51.230.253:53 *:* 276
UDP 206.51.230.253:123 *:* 1424
UDP 206.51.230.254:53 *:* 276
UDP 206.51.230.254:123 *:* 1424

D:\temp>netstat /aes
Interface Statistics

Received Sent

Bytes 2174696090 2473642980
Unicast packets 21196137 20932456
Non-unicast packets 2450229 1160
Discards 0 0
Errors 0 224
Unknown protocols 4475

IPv4 Statistics

Packets Received = 21313378
Received Header Errors = 1
Received Address Errors = 93761
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 142
Received Packets Delivered = 21219563
Output Requests = 20931466
Routing Discards = 0
Discarded Output Packets = 0
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0

ICMPv4 Statistics

Received Sent
Messages 1424 870
Errors 0 0
Destination Unreachable 597 568
Time Exceeded 7 0
Parameter Problems 0 0
Source Quenches 0 0
Redirects 0 0
Echos 302 0
Echo Replies 0 302
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0

TCP Statistics for IPv4

Active Opens = 40
Passive Opens = 26785
Failed Connection Attempts = 22
Reset Connections = 674
Current Connections = 109
Segments Received = 21051978
Segments Sent = 20770363
Segments Retransmitted = 65428

UDP Statistics for IPv4

Datagrams Received = 142075
No Ports = 1704
Receive Errors = 0
Datagrams Sent = 143784

D:\temp>echo 252
252

D:\temp>sleep 10

D:\temp>date /T
2005-10-29 ???

D:\temp>time /T
18:04

D:\temp>netstat -ano

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:26 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1300
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING 964
TCP 0.0.0.0:1032 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1033 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1034 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING 3432
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 780
TCP 0.0.0.0:7000 0.0.0.0:0 LISTENING 3232
TCP 0.0.0.0:7100 0.0.0.0:0 LISTENING 3848
TCP 0.0.0.0:7200 0.0.0.0:0 LISTENING 2712
TCP 0.0.0.0:7210 0.0.0.0:0 LISTENING 2924
TCP 0.0.0.0:7220 0.0.0.0:0 LISTENING 3252
TCP 0.0.0.0:7600 0.0.0.0:0 LISTENING 2624
TCP 0.0.0.0:63000 0.0.0.0:0 LISTENING 1668
TCP 61.128.194.170:63000 61.128.194.170:1068 CLOSE_WAIT 1668
TCP 54.64.27.66:3389 65.94.60.172:63175 ESTABLISHED 780
TCP 54.64.27.66:7000 69.193.130.232:1107 FIN_WAIT_2 3232
TCP 54.64.27.66:7000 70.25.53.43:3155 ESTABLISHED 3232
TCP 54.64.27.66:7000 82.25.46.130:1317 ESTABLISHED 3232
TCP 54.64.27.66:7000 84.99.211.97:35916 ESTABLISHED 3232
TCP 54.64.27.66:7000 156.34.165.41:1475 ESTABLISHED 3232
TCP 54.64.27.66:7000 210.221.74.59:1378 ESTABLISHED 3232
TCP 54.64.27.66:7000 213.224.120.43:4301 ESTABLISHED 3232
TCP 54.64.27.66:7200 60.229.211.10:3395 TIME_WAIT 0
TCP 54.64.27.66:7200 60.229.211.10:3734 TIME_WAIT 0
TCP 54.64.27.66:7200 67.189.175.214:62664 TIME_WAIT 0
TCP 54.64.27.66:7200 68.51.37.76:2702 TIME_WAIT 0
TCP 54.64.27.66:7200 69.193.130.232:1110 TIME_WAIT 0
TCP 54.64.27.66:7200 82.25.46.130:1320 TIME_WAIT 0
TCP 54.64.27.66:7200 82.57.44.110:4701 TIME_WAIT 0
TCP 54.64.27.66:7200 82.88.99.110:2226 TIME_WAIT 0
TCP 54.64.27.66:7200 84.112.93.232:62183 TIME_WAIT 0
TCP 54.64.27.66:7200 154.20.81.33:33063 TIME_WAIT 0
TCP 54.64.27.66:7200 205.251.120.150:50380 TIME_WAIT 0
TCP 54.64.27.66:7200 212.139.35.155:2497 TIME_WAIT 0
TCP 54.64.27.66:7200 212.139.35.155:2551 TIME_WAIT 0
TCP 54.64.27.66:7210 62.101.126.208:34791 TIME_WAIT 0
TCP 54.64.27.66:7210 68.10.213.201:1865 TIME_WAIT 0
TCP 54.64.27.66:7210 68.51.37.76:2728 TIME_WAIT 0
TCP 54.64.27.66:7210 69.104.90.179:3028 TIME_WAIT 0
TCP 54.64.27.66:7210 69.104.90.179:4542 TIME_WAIT 0
TCP 54.64.27.66:7210 69.193.130.232:1115 TIME_WAIT 0
TCP 54.64.27.66:7210 82.53.35.236:3077 TIME_WAIT 0
TCP 54.64.27.66:7210 83.114.179.234:4801 TIME_WAIT 0
TCP 54.64.27.66:7210 86.132.101.6:2928 TIME_WAIT 0
TCP 54.64.27.66:7210 144.131.196.91:61853 TIME_WAIT 0
TCP 54.64.27.66:7210 212.194.239.225:1225 TIME_WAIT 0
TCP 54.64.27.66:7220 24.253.197.142:3562 TIME_WAIT 0
TCP 54.64.27.66:7220 60.229.211.10:1594 TIME_WAIT 0
TCP 54.64.27.66:7220 60.229.211.10:2932 TIME_WAIT 0
TCP 54.64.27.66:7220 65.92.159.96:61857 TIME_WAIT 0
TCP 54.64.27.66:7220 68.83.65.174:3940 TIME_WAIT 0
TCP 54.64.27.66:7220 69.192.3.34:1786 TIME_WAIT 0
TCP 54.64.27.66:7220 70.51.122.82:2036 TIME_WAIT 0
TCP 54.64.27.66:7220 80.227.165.45:3242 FIN_WAIT_2 3252
TCP 54.64.27.66:7220 81.208.106.72:19227 TIME_WAIT 0
TCP 54.64.27.66:7220 149.167.122.39:3927 TIME_WAIT 0
TCP 54.64.27.66:7220 151.202.106.189:50304 TIME_WAIT 0
TCP 54.64.27.66:7220 203.79.103.148:1627 TIME_WAIT 0
TCP 54.64.27.66:7220 213.140.22.64:24198 TIME_WAIT 0
TCP 54.64.27.66:7220 213.224.120.43:2271 TIME_WAIT 0
TCP 127.0.0.1:1035 0.0.0.0:0 LISTENING 1412
TCP 127.0.0.1:1040 127.0.0.1:5500 ESTABLISHED 3232
TCP 127.0.0.1:1041 127.0.0.1:5100 ESTABLISHED 3848
TCP 127.0.0.1:1043 127.0.0.1:5600 ESTABLISHED 3012
TCP 127.0.0.1:1044 127.0.0.1:5600 TIME_WAIT 0
TCP 127.0.0.1:1072 127.0.0.1:6000 TIME_WAIT 0
TCP 127.0.0.1:1326 127.0.0.1:5000 SYN_SENT 2924
TCP 127.0.0.1:1327 127.0.0.1:5000 SYN_SENT 3252
TCP 127.0.0.1:1328 127.0.0.1:5000 SYN_SENT 2712
TCP 127.0.0.1:5000 127.0.0.1:1071 TIME_WAIT 0
TCP 127.0.0.1:5100 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:5100 127.0.0.1:1041 ESTABLISHED 3012
TCP 127.0.0.1:5500 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5500 127.0.0.1:1040 ESTABLISHED 3432
TCP 127.0.0.1:5600 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5600 127.0.0.1:1043 ESTABLISHED 3432
TCP 127.0.0.1:6000 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:43958 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.177:139 0.0.0.0:0 LISTENING 4
TCP 206.51.230.177:3389 86.132.101.6:1071 ESTABLISHED 780
TCP 206.51.230.254:21 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.254:21 69.156.60.183:2219 ESTABLISHED 2776
TCP 206.51.230.254:1298 0.0.0.0:0 LISTENING 2776
UDP 0.0.0.0:161 *:* 748
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 964
UDP 0.0.0.0:1026 *:* 276
UDP 0.0.0.0:1030 *:* 748
UDP 0.0.0.0:1037 *:* 1400
UDP 0.0.0.0:3456 *:* 588
UDP 0.0.0.0:4500 *:* 964
UDP 0.0.0.0:10000 *:* 3620
UDP 61.128.194.170:53 *:* 276
UDP 61.128.194.170:123 *:* 1424
UDP 54.64.27.66:53 *:* 276
UDP 54.64.27.66:123 *:* 1424
UDP 127.0.0.1:53 *:* 276
UDP 127.0.0.1:123 *:* 1424
UDP 127.0.0.1:1025 *:* 276
UDP 127.0.0.1:3456 *:* 588
UDP 206.51.230.177:53 *:* 276
UDP 206.51.230.177:123 *:* 1424
UDP 206.51.230.177:137 *:* 4
UDP 206.51.230.177:138 *:* 4
UDP 206.51.230.178:53 *:* 276
UDP 206.51.230.178:123 *:* 1424
UDP 206.51.230.179:53 *:* 276
UDP 206.51.230.179:123 *:* 1424
UDP 206.51.230.253:53 *:* 276
UDP 206.51.230.253:123 *:* 1424
UDP 206.51.230.254:53 *:* 276
UDP 206.51.230.254:123 *:* 1424

D:\temp>netstat /aes
Interface Statistics

Received Sent

Bytes 2174989604 2473934091
Unicast packets 21197029 20933394
Non-unicast packets 2450749 1160
Discards 0 0
Errors 0 224
Unknown protocols 4476

IPv4 Statistics

Packets Received = 21314332
Received Header Errors = 1
Received Address Errors = 93817
Datagrams Forwarded = 0
Unknown Protocols Received = 0
Received Packets Discarded = 142
Received Packets Delivered = 21220446
Output Requests = 20932382
Routing Discards = 0
Discarded Output Packets = 0
Output Packet No Route = 0
Reassembly Required = 0
Reassembly Successful = 0
Reassembly Failures = 0
Datagrams Successfully Fragmented = 0
Datagrams Failing Fragmentation = 0
Fragments Created = 0

ICMPv4 Statistics

Received Sent
Messages 1424 870
Errors 0 0
Destination Unreachable 597 568
Time Exceeded 7 0
Parameter Problems 0 0
Source Quenches 0 0
Redirects 0 0
Echos 302 0
Echo Replies 0 302
Timestamps 0 0
Timestamp Replies 0 0
Address Masks 0 0
Address Mask Replies 0 0

TCP Statistics for IPv4

Active Opens = 67
Passive Opens = 26794
Failed Connection Attempts = 49
Reset Connections = 724
Current Connections = 16
Segments Received = 21052808
Segments Sent = 20771179
Segments Retransmitted = 65487

UDP Statistics for IPv4

Datagrams Received = 142075
No Ports = 1704
Receive Errors = 0
Datagrams Sent = 143784

After that, most of connections were lost.

Active Connections

Proto Local Address Foreign Address State PID
TCP 0.0.0.0:26 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1300
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING 964
TCP 0.0.0.0:1032 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1033 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1034 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING 3432
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 780
TCP 0.0.0.0:7000 0.0.0.0:0 LISTENING 3232
TCP 0.0.0.0:7100 0.0.0.0:0 LISTENING 3848
TCP 0.0.0.0:7200 0.0.0.0:0 LISTENING 2712
TCP 0.0.0.0:7210 0.0.0.0:0 LISTENING 2924
TCP 0.0.0.0:7220 0.0.0.0:0 LISTENING 3252
TCP 0.0.0.0:7600 0.0.0.0:0 LISTENING 2624
TCP 0.0.0.0:63000 0.0.0.0:0 LISTENING 1668
TCP 61.128.194.170:63000 61.128.194.170:1068 CLOSE_WAIT 1668
TCP 54.64.27.66:3389 65.94.60.172:63175 ESTABLISHED 780
TCP 54.64.27.66:7000 60.229.211.10:1656 ESTABLISHED 3232
TCP 54.64.27.66:7000 65.92.159.96:64683 ESTABLISHED 3232
TCP 54.64.27.66:7000 68.63.135.119:4518 LAST_ACK 3232
TCP 54.64.27.66:7000 70.25.53.43:3169 ESTABLISHED 3232
TCP 54.64.27.66:7000 82.25.46.130:1317 FIN_WAIT_2 3232
TCP 54.64.27.66:7000 83.89.57.234:3965 ESTABLISHED 3232
TCP 54.64.27.66:7000 84.99.211.97:35939 ESTABLISHED 3232
TCP 54.64.27.66:7000 84.130.134.152:1564 ESTABLISHED 3232
TCP 54.64.27.66:7000 142.162.34.75:61612 ESTABLISHED 3232
TCP 54.64.27.66:7000 144.131.196.91:61868 ESTABLISHED 3232
TCP 54.64.27.66:7000 156.34.165.41:1495 FIN_WAIT_2 3232
TCP 54.64.27.66:7000 203.122.115.135:50151 ESTABLISHED 3232
TCP 54.64.27.66:7000 203.122.115.135:50161 ESTABLISHED 3232
TCP 54.64.27.66:7000 203.122.115.135:50163 ESTABLISHED 3232
TCP 54.64.27.66:7000 210.221.74.59:1392 ESTABLISHED 3232
TCP 127.0.0.1:1035 0.0.0.0:0 LISTENING 1412
TCP 127.0.0.1:1040 127.0.0.1:5500 ESTABLISHED 3232
TCP 127.0.0.1:1041 127.0.0.1:5100 ESTABLISHED 3848
TCP 127.0.0.1:1043 127.0.0.1:5600 ESTABLISHED 3012
TCP 127.0.0.1:1525 127.0.0.1:5000 SYN_SENT 2712
TCP 127.0.0.1:1526 127.0.0.1:5000 SYN_SENT 3252
TCP 127.0.0.1:1527 127.0.0.1:5000 SYN_SENT 2924
TCP 127.0.0.1:5100 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:5100 127.0.0.1:1041 ESTABLISHED 3012
TCP 127.0.0.1:5500 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5500 127.0.0.1:1040 ESTABLISHED 3432
TCP 127.0.0.1:5600 0.0.0.0:0 LISTENING 3432
TCP 127.0.0.1:5600 127.0.0.1:1043 ESTABLISHED 3432
TCP 127.0.0.1:6000 0.0.0.0:0 LISTENING 3012
TCP 127.0.0.1:43958 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.177:139 0.0.0.0:0 LISTENING 4
TCP 206.51.230.177:3389 86.132.101.6:1071 ESTABLISHED 780
TCP 206.51.230.254:21 0.0.0.0:0 LISTENING 2776
TCP 206.51.230.254:21 69.156.60.183:2219 ESTABLISHED 2776
TCP 206.51.230.254:1359 0.0.0.0:0 LISTENING 2776
UDP 0.0.0.0:161 *:* 748
UDP 0.0.0.0:445 *:* 4
UDP 0.0.0.0:500 *:* 964
UDP 0.0.0.0:1026 *:* 276
UDP 0.0.0.0:1030 *:* 748
UDP 0.0.0.0:1037 *:* 1400
UDP 0.0.0.0:3456 *:* 588
UDP 0.0.0.0:4500 *:* 964
UDP 0.0.0.0:10000 *:* 3620
UDP 61.128.194.170:53 *:* 276
UDP 61.128.194.170:123 *:* 1424
UDP 54.64.27.66:53 *:* 276
UDP 54.64.27.66:123 *:* 1424
UDP 127.0.0.1:53 *:* 276
UDP 127.0.0.1:123 *:* 1424
UDP 127.0.0.1:1025 *:* 276
UDP 127.0.0.1:3456 *:* 588
UDP 206.51.230.177:53 *:* 276
UDP 206.51.230.177:123 *:* 1424
UDP 206.51.230.177:137 *:* 4
UDP 206.51.230.177:138 *:* 4
UDP 206.51.230.178:53 *:* 276
UDP 206.51.230.178:123 *:* 1424
UDP 206.51.230.179:53 *:* 276
UDP 206.51.230.179:123 *:* 1424
UDP 206.51.230.253:53 *:* 276
UDP 206.51.230.253:123 *:* 1424
UDP 206.51.230.254:53 *:* 276
UDP 206.51.230.254:123 *:* 1424更多精彩文章及讨论，请光临枫下论坛 rolia.net

Here is my suggestion to you friend: Your server has too many services running there. You can either add a firewall or disable no useful services ... -bugfree(BugFree); 2005-10-30 {1046} (#2580605@0)
本文发表在 rolia.net 枫下论坛I assume the main two ports your game server depending on are 7220 and 7210. You use windows Remote desktop to manage your server (port 3389). I do not know what service running on port 7000. And all rest services you can close if you do not needed. I did not cover the UDP services.

TCP 0.0.0.0:26 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:53 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 1300
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:1027 0.0.0.0:0 LISTENING 276
TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING 964
TCP 0.0.0.0:1032 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1033 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:1034 0.0.0.0:0 LISTENING 588
TCP 0.0.0.0:3000 0.0.0.0:0 LISTENING 3432
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 780
TCP 0.0.0.0:7000 0.0.0.0:0 LISTENING 3232
TCP 0.0.0.0:7100 0.0.0.0:0 LISTENING 3848
TCP 0.0.0.0:7200 0.0.0.0:0 LISTENING 2712
TCP 0.0.0.0:7210 0.0.0.0:0 LISTENING 2924
TCP 0.0.0.0:7220 0.0.0.0:0 LISTENING 3252
TCP 0.0.0.0:7600 0.0.0.0:0 LISTENING 2624
TCP 0.0.0.0:63000 0.0.0.0:0 LISTENING 1668更多精彩文章及讨论，请光临枫下论坛 rolia.net

Thanks, I will let them know. -randomwalk(*%_%*); 2005-10-31 (#2581763@0)

用网络监视软件，对数据报内容进行分析，可以有效防范恶意攻击 -lionheart(lionheart); 2005-10-30 (#2580734@0)

@Las Vegas

Here is my suggestion to you friend: Your server has too many services running there. You can either add a firewall or disable no useful services ...

Replies, comments and Discussions:

More Topics