Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

If this is in the wrong section, please move it to the correct section, as I'm new to this website.

Hi. I've been told to email abuse@verizon.net, which I've already done, however, receving an automatic response with the following hasn't given me much confidence, with it saying the following..

"Unfortunately, we cannot investigate or respond to each email that we receive, but we will attempt to identify and review those emails where we think action is needed."

so I decided to post here. I have a Verizon customer sending UDP packets around the clock, 24 hours a day, 7 days a week. I've not had any torrenting programs running and these packets are coming even when everything's closed off. I have minor log files saved and the person's IP continues at this moment to be showing up on my firewall, though is blocked.

My questions are,,

1: What is the average waiting time from such support from Verizon?

and..

2: If I don't get a response within that time period, is there any Verizon staff here that I can contact?

Re: Attempted UDP flooder.
smith6612
Community Leader
Community Leader

From personal experience, tech support at Verizon has a different wait time based on the time of day. Towards mid-afternoon it is usually a half hour. Late at night it tends to be only a few minutes. I wouldn't place too many bets in the support getting to the abuse department to see what the deal is, but there are Verizon employees around here that tend to stop by from time to time.

By any chance, would you mind posting up the firewall logs without the IP addresses? It might be worthwhile to share.

Re: Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

Thanks for the response, Smith.

As for the logs, this is all it shows on my firewall. The parts come in 1200 bytes. This is just part of what it shows. This flood comes three times faster than this though, but my firewall overwrites the previous two, only showing the third wave of UDP packets each time it's been done.

 

15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50297, Destination port: 12885
status..........
15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50313, Destination port: 12886
status..........
15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50298, Destination port: 12887
status..........
15:15:40 An incoming packet(Blocked) Protocol: UDP, Source port: 50299, Destination port: 12888
status..........
15:15:40 An incoming packet(Blocked) Protocol: UDP, Source port: 50303, Destination port: 12889
status..........

 The Destination Ports are my gaming servers. Removed some kid for cheating, the next day the UDP packets started coming in and have been since. I didn't know what to do about it at first, other than keeping the kid's IP blocked, but someone was nice enough to point me to the abuse email.

The Souce Ports are always random.

My internet company however has data limits and I don't know if this will do any damage in that area, which's why I'd like this resolved as soon as possible.

I'd expect any internet service provider to be active in such a case and it's disappointing to read that the abuse support email sounds like a waste of time. I want to go through Veizon before taking it up with my own internet service prodiver, so I have shown them that I've gone through all I can, so I hope Verizon can do something. 
Re: Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

I'm also curious why it says my thread has been "solved". I've yet to have seen or read anything as for this problem being solved, seeing how I can still see the IP flooding my firewall. 

Re: Attempted UDP flooder.
smith6612
Community Leader
Community Leader

Sounds typical of what people do when getting banned from games. I myself run game servers off of a dedicated server in Chicago. For the most part people just leave the server alone when they get banned, and come back when the ban expires (I rarely ban, anyways). In some cases though, typically griefers, I have to ban them because they are causing issues with a particular game server instance. Those players usually wind up flooding the box minutes later. I don't know what they try to accomplish but they don't accomplish anything.

Good luck in getting the attack stopped. If they aren't flooding the line with anything significant, I wouldn't worry about it. They give up eventually.

You may have accidentally bumped the "Mark as Solution" button instead of pushing reply. A moderator can remove it.

Re: Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

Ah, ok. Thanks for info about the solution button. I didn't realize. Well, I hope a moderator removed that and I hope I hope someone from Verizon notices this thread, seeing how I can't call the U.S.A without it costing me a fortune, since I'm in another country. Thanks for your time, Smith. I'll sit back, wait and check each day, but sadly, this one isn't giving up anytime soon with the attacks, seeing how after the ban, he now runs his own server. He has two different internet service providers where he lives, but is using Verizon for the UDP attacks.

Re: Attempted UDP flooder.
KH-OrnEsh1
Moderator Emeritus

I'm sorry you are having difficulty. An agent will reach out to you directly by email or private message in the Forums for more information or to help you resolve your issue.


@GavinM wrote:

Thanks for the response, Smith.

As for the logs, this is all it shows on my firewall. The parts come in 1200 bytes. This is just part of what it shows. This flood comes three times faster than this though, but my firewall overwrites the previous two, only showing the third wave of UDP packets each time it's been done.

 

15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50297, Destination port: 12885
status..........
15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50313, Destination port: 12886
status..........
15:15:39 An incoming packet(Blocked) Protocol: UDP, Source port: 50298, Destination port: 12887
status..........
15:15:40 An incoming packet(Blocked) Protocol: UDP, Source port: 50299, Destination port: 12888
status..........
15:15:40 An incoming packet(Blocked) Protocol: UDP, Source port: 50303, Destination port: 12889
status..........

 The Destination Ports are my gaming servers. Removed some kid for cheating, the next day the UDP packets started coming in and have been since. I didn't know what to do about it at first, other than keeping the kid's IP blocked, but someone was nice enough to point me to the abuse email.

The Souce Ports are always random.

My internet company however has data limits and I don't know if this will do any damage in that area, which's why I'd like this resolved as soon as possible.

I'd expect any internet service provider to be active in such a case and it's disappointing to read that the abuse support email sounds like a waste of time. I want to go through Veizon before taking it up with my own internet service prodiver, so I have shown them that I've gone through all I can, so I hope Verizon can do something. 



Re: Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

Alrighy, ornahp. I'll sit back, wait and check each day. Thanks for the response and the solution change.

Re: Attempted UDP flooder.
GavinM1
Enthusiast - Level 2

Well, today I noticed the attacks stopped, but only because my IP changed overnight. I do believe that this person's still running whatever program with the attacks running and hasn't taken notice of the IP change on my end.

Having not received a reply by email or private message for 3 days, I don't know if that's not long enough for me to be waiting.

My question is will the person's internet activity be looked into even though the attacks have stopped on my end or what? I still have the person's IP and he's probably still attempting to UDP flood the previous IP, which I still have to.

I'd be more than happy to talk over the phone to someone at Verizon, however it costs a buck-load of money for me to be calling the U.S.A from where I'm at.

I honestly want this person to have a record of such behaviour. 

Re: Attempted UDP flooder.
Techman28
Master - Level 1

send me a PM with the IP that was flooding you I'll see what I can do to stop it once and for all.

0 Likes