My server was hit by a flood from a single IP targeting a specific port (7777), which was captured using tcpdump, like so:
16:38:35.079994 IP 184.108.40.206.58074 > 220.127.116.11.7777: UDP, length 4
I attempted to block the source IP using two methods:
ip route add blackhole 18.104.22.168/32 iptables -A INPUT -s 22.214.171.124 -j DROP
However, tcpdump reported no change - the traffic from the IP kept coming. And my server was still feeling the effect of it (services barely responsive).
Am I missing something here? Why did my attempt to block the IP have no impact at all?