On 20.08.2004 23:58:18 +0000, van Helsing wrote: > I've a server and it's DDoSed for a week now. > I informed the ISPs but they don't react so what else can I do to stop a > damn DDoS attack? >
You have to ask your ISP to null-route you ip. I don't know much about legislation, but I do think that the approach you will have the most luck with, would be to change your SLA or contract with your ISP, to include mechanisms for preventing and/or limiting DDoS attacks. This is quite possible for them, if they use tools such as Arbour. I don't think you'll have any luck with contacting the authorities on this.. /Steffen > My server shows me about some houndrets entry like: > > tcp 0 0 62.8.206.154.80 129.125.220.178.2056 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2011 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 83.27.195.87.13242 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 129.125.220.178.2055 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2010 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 129.125.220.178.2054 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2008 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 129.125.220.178.2053 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2007 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 129.125.220.178.2052 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2006 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 129.125.220.178.2051 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 83.27.195.87.13240 > FIN_WAIT_2 > tcp 0 0 62.8.206.154.80 24.101.73.167.2005 > FIN_WAIT_2 > > > So what can I do? > Or: Could somebody tell me how to contact the police in poland, > netherland and the other country? > > Thanks for some tipps.... > > > vh _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
