<![CDATA[Web-based real-time communication services possess vulnerabilities originating from UDP Flood, which serve as a loophole for cyberattack threats. This study aims to analyze the effectiveness of a Snort-based Intrusion Prevention System (IPS) in mitigating packet flood attacks on WebRTC applications within a Virtual Private Server (VPS). This research employs an experimental NDLC method. The attack testing was conducted using Kali Linux from a VPS cekrescirebon.cloud. The testing was performed by simulating UDP Flood attacks using the hping3 tool on port 3478, targeting the turnserver service. Observations were carried out through hardware performance parameters using htop, as well as network traffic monitoring via iftop and tshark to monitor the Quality of Service (QoS). Attacks were classified into low, medium, and high levels. The observation results show that low and medium-level attacks did not reach 100% CPU usage, and RAM resources were not fully exhausted. However, high-level attacks without protection resulted in significant system anomalies, where CPU usage surged to 100% and RAM consumption increased critically, potentially leading to a total Denial of Service (DoS). The implementation of Snort IPS with the Data Acquisition (DAQ) mechanism via the Netfilter Queue (NFQ) module proved to be the optimal solution for the single-interface architecture of the VPS. By applying local rules with a "drop" action, Snort successfully identified and automatically terminated illegal traffic once the attack threshold was exceeded. Final data demonstrate drastic system efficiency, where the CPU load decreased back to a stable level below 5% despite the ongoing attack. This study concludes that the integration of Snort IPS with NFQ configuration provides robust proactive protection, maintains server resource availability, and ensures the stability of WebRTC services against data flood-based exploitation threats.]]>
Copyrights © 2026
