Re: root servers DDoS

2002-10-21 Thread Paul Vixie
[EMAIL PROTECTED] (Sean Donelan) writes: > Best guess, its a smurf attack. Networks which still have ip > directed-broadcast (or your vendor's equivalent) enabled on interfaces. > > Its still amazing how much traffic it can generate. however, this attack was icmp request, not icmp reply. -- Pa

Re: root servers DDoS

2002-10-21 Thread John M. Brown
I don't think so. We saw problems about 15 min before the nsp-sec list posting, and at that point the volume was turned up.. I don't beleive ICANN received any "advance" warning but don't quote me on that. I'll go find out though in private, john brown On Mon, Oct 21, 2002 at 05:38:32P

Re: root servers DDoS

2002-10-21 Thread Matthew Richardson
On Tue, 22 Oct 2002, Petri Helenius wrote: > Anyone have insight into the (seemingly) DoS attack on root-servers > which started around 20 UTC and widened to more servers on 20:35 UTC? > > Not that it´s causing any serious operational problems but slows down > things a lot. We have automated mon

Re: root servers DDoS

2002-10-21 Thread Sean Donelan
On Tue, 22 Oct 2002, Petri Helenius wrote: > I´ve prettier graphs. I sent the mail after the performance started lacking > asking if anyone has an idea what´s going on and where the traffic is > originating. Best guess, its a smurf attack. Networks which still have ip directed-broadcast (or your

Re: root servers DDoS

2002-10-21 Thread Petri Helenius
>You can see pretty graphs of the server performance at > >http://www.root-servers.net/ >http://www.cymru.com/DNS/dns.html I´ve prettier graphs. I sent the mail after the performance started lacking asking if anyone has an idea what´s going on and where the traffic is originating. Pete

Re: root servers DDoS

2002-10-21 Thread Peter Salus
That's root-servers.org, Sean. Peter

Re: root servers DDoS

2002-10-21 Thread Sean Donelan
On Tue, 22 Oct 2002, Petri Helenius wrote: > Anyone have insight into the (seemingly) DoS attack on root-servers which > started around 20 UTC and widened to more servers on 20:35 UTC? > > Not that it´s causing any serious operational problems but slows down things a > lot. You can see pretty gra

root servers DDoS

2002-10-21 Thread Petri Helenius
Anyone have insight into the (seemingly) DoS attack on root-servers which started around 20 UTC and widened to more servers on 20:35 UTC? Not that it´s causing any serious operational problems but slows down things a lot. Pete