I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is located.)
I managed to log onto the server and start capturing packets using wireshark.
In total there was 2,613,561 packets sent from 40,000+ different ip addresses(According to wireshark.) I rent boxes from OVH, their ddos mitigation appears to not have any affect on this attack as it went on for over two hours.
AFter inspecting the packets with wireshark the majority of them are directed at port 27115(where a game server is located) and contain "TSource Engine Query" in the data.
Image: https://gyazo.com/954be1929a5035469453b1a557e8281e
I can provide the wireshark capture file if needed, i managed to capture packets for most of the duration of the attack.
Thank you.