Home / server / Questions / 116712
Accepted
Alon Gubkin
Asked: 2010-02-26 04:56:01 +0800 CST

Log Server Packets

  • 772

Hey, Some script kiddies are crashing my clients' game servers (that are based on Linux). In order to serve the best service, I'm looking for a way to find what packets does the crashers send, so I can block it later.

So, I need a simple program, that will log every packet that sent or get to/from the server software, from ALL clients. As I said, the game server software is based on Linux (Ubuntu 9.10), so the program should support Linux. The game server software, is not open source.

Thanks.

linux logging gameserver

2 Answers

  1. Best Answer

    Wireshark comes to mind - or tshark for console version. Both should be available in Karmic Koala repositories.

    Note that all traffic could mean tens, hundreds, or thousands of Mb/sec, so check your server's average traffic and prepare for that (the data needs to be stored somewhere, NOT on a network on the same interface (otherwise you'll be generating an infinite loop of data)).

    Edit: As @William says, iff the game server itself is crashing, data may not be written to disk in time; but in that case, they may not even be sent out of another network interface in time. In my opinion, this is less likely than only the application crashing, but iff it's the case, I'd do this:

    Put another computer with two NICs in front of your server, bridge them together and capture on that host in promiscuous mode (Those interfaces need not even have an IP address).

    [game server[eth0]]------[[eth1]capturing computer[eth0]]-----[[eth1]your router, the Net etc]

    What I'm doing here: the capturing computer pretends that there's a single network segment between your game server and your router (although physically there are now two). Therefore, the capturing computer will see all the traffic between game server and router, but the TCP and UDP traffic itself is not altered. Now, even if game server crashes, you'll still have all the preceding traffic.

    The method described may slow down the line a little (as the capturing computer has to bridge the packets back and forth), but unless you're dealing with gigabit throughput, this shouldn't be too noticeable.

    • 1

  2. You can use tcpdump to log the packets.

    An option directed towards analysis of the traffic might be snort ( http://www.snort.org/).

    • 0