[Woet]

Use tcpdump to find the attacker.

Код:

tcpdump -n | grep SERVER_PORT | grep "length 2"

Find a suspicious IP (lots of packets of length 2)

Код:

tcpdump -n | grep SUSPICIOUS_IP

If it does indeed send a lot of those packets, ban it.

Код:

iptables -A INPUT -s SUSPICIOUS_IP -j DROP