Re: [External] announcing IPs by scrubbing service to help with DDoS attacks and ROAs

2023-11-17 Thread Amir Herzberg
unty logo] > > > > > > *From:* NANOG *On Behalf > Of *Amir Herzberg > *Sent:* Thursday, November 16, 2023 19:58 > *To:* NANOG > *Subject:* [External] announcing IPs by scrubbing service to help with > DDoS attacks and ROAs > > > > *CAUTION:* Th

RE: [External] announcing IPs by scrubbing service to help with DDoS attacks and ROAs

2023-11-16 Thread Tom Krenn via NANOG
: [External] announcing IPs by scrubbing service to help with DDoS attacks and ROAs CAUTION: This email was sent from outside of Hennepin County. Unless you recognize the sender and know the content, do not click links or open attachments. Hi, do people use scrubbing services, when under DDoS attack

announcing IPs by scrubbing service to help with DDoS attacks and ROAs

2023-11-16 Thread Amir Herzberg
Hi, do people use scrubbing services, when under DDoS attack, by having the scrubbing service announce the attacked IP prefix(es)? If so, and you have a ROA for these prefixes, do you authorize the scrubbing AS (by issuing ROA or otherwise), and if so, do you do it in advance or only when you

DDoS Attacks targeting VPN/IPSEC endpoints

2020-03-17 Thread Dennis B
Any one else seeing this? Hearing some isolated events across different industry segments. If you are, can you provide any TTPs?

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-26 Thread Amir Herzberg
I have no idea who was the reviewer (academic or industry or whatever). However, he didn't actually object to the assertion that latency increases with congestion; he only raised the question of the which latency values would be typical/reasonable for a congestion DoS attack. Notice also that the

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-26 Thread Saku Ytti
On Sun, 26 Jan 2020 at 13:11, Etienne-Victor Depasquale wrote: > " he/she doubts that delays increase significantly under network congestion > since he/she thinks that the additional queuing is something mostly in small > routers such as home routers (and maybe like the routers used in our >

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-26 Thread Etienne-Victor Depasquale
gt;> increases traffic rather than the typical congestion-control approach of >>> reducing it, I'm well aware of it; but some applications are critical (and >>> often low-bandwidth) so such tool is important. >>> >>> I am looking for data on loss rate and cong

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-25 Thread Amir Herzberg
. Guys: if you can share data but only privately, please do :) thanks! Amir -- Amir On Sat, Jan 25, 2020 at 12:38 PM Damian Menscher wrote: > Getting (and releasing) numbers from DDoS attacks will be challenging for > most, but I think your research could apply to more than jus

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-25 Thread Damian Menscher via NANOG
Getting (and releasing) numbers from DDoS attacks will be challenging for most, but I think your research could apply to more than just DDoS. There are often cases where one might want to work from an environment which has very poor networking. As an extreme example, in 2007 I got online from

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-25 Thread Amir Herzberg
ased on data you see now > it may seem reasonable, but now is only result of minimum viable ddos, > which is trivial to increase should need occur. I still think evaluation should preferably compare to attacks reported in reality, with potential additional analysis of projections of potenti

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-24 Thread Saku Ytti
um viable ddos, which is trivial to increase should need occur. Similarly DDoS attacks are excessive dumb often, like dumb UDP ports which are easy drop, but should we solve protection well for these, it's trivial to make it proper HTTPS TCP SYN. > Also, latency values (under congestion) would be ap

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-24 Thread Amir Herzberg
ions are critical (and >> often low-bandwidth) so such tool is important. >> >> I am looking for data on loss rate and congestion of DDoS attacks to make >> sure we use right parameters. Any chance you have such data and can share? >> >> Many thanks! >> -- &

Re: Data on latency and loss-rates during congestion DDoS attacks

2020-01-24 Thread Damian Menscher via NANOG
pproach of > reducing it, I'm well aware of it; but some applications are critical (and > often low-bandwidth) so such tool is important. > > I am looking for data on loss rate and congestion of DDoS attacks to make > sure we use right parameters. Any chance you have such data and can

Data on latency and loss-rates during congestion DDoS attacks

2020-01-24 Thread Amir Herzberg
clearly increases traffic rather than the typical congestion-control approach of reducing it, I'm well aware of it; but some applications are critical (and often low-bandwidth) so such tool is important. I am looking for data on loss rate and congestion of DDoS attacks to make sure we use right

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Randy Bush
The idea of restricting access to a certain content during an attack on the trusted networks only will make all interested ISPs be more trusted don't the lawyers already have enough money?

RE: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Keith Medcalf
networks. -Original Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Ramy Hashish Sent: Sunday, 24 May, 2015 22:49 To: morrowc.li...@gmail.com; nanog@nanog.org Subject: Re: [SECURITY] Application layer attacks/DDoS attacks The idea of restricting access to a certain

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread jim deleskie
Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Ramy Hashish Sent: Sunday, 24 May, 2015 22:49 To: morrowc.li...@gmail.com; nanog@nanog.org Subject: Re: [SECURITY] Application layer attacks/DDoS attacks The idea of restricting access to a certain content during an attack

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Roland Dobbins
On 25 May 2015, at 19:44, Keith Medcalf wrote: Whatever this trusted network initiative is, I take that it was designed by fools or government (the two are usually indistinguishable) for the purpose of creating utterly untrustworthy networks. AFAICT, the 'Trusted Network Initiative'

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Roland Dobbins
On 25 May 2015, at 19:49, jim deleskie wrote: I agree, we can't even get everyone including some LARGE ( I'll avoid Tier's because people get stupid around that too) networks to filter customers based on assigned netblocks. Customer of my customer [of my customer, of my customer . . . ].

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Steve via NANOG
Application layer DDoS attacks , in most (all?) cases require a valid TCP/IP connection, therefore are not spoofed and BCP38 is irrelevant Sent from Steve's iPhone On May 25, 2015, at 8:00 AM, nanog-requ...@nanog.org wrote: Send NANOG mailing list submissions to nanog@nanog.org

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Roland Dobbins
On 25 May 2015, at 20:31, Steve via NANOG wrote: Application layer DDoS attacks , in most (all?) cases require a valid TCP/IP connection DNS query-floods are a notable exception. --- Roland Dobbins rdobb...@arbor.net

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Randy Bush
Application layer DDoS attacks , in most (all?) cases require a valid TCP/IP connection DNS query-floods are a notable exception. may i remind you of the dns query flood i had which you helped research? udp and tcp, from the same sources. randy

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-25 Thread Roland Dobbins
On 26 May 2015, at 4:27, Randy Bush wrote: may i remind you of the dns query flood i had which you helped research? udp and tcp, from the same sources. Yes - we determined that the TCP-based queries were a result of RRL, which is optimized to help with spoofed reflection/amplification

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-24 Thread Ramy Hashish
The idea of restricting access to a certain content during an attack on the trusted networks only will make all interested ISPs be more trusted Ramy On Mon, May 25, 2015 at 5:01 AM, Christopher Morrow morrowc.li...@gmail.com wrote: On Sat, May 23, 2015 at 9:12 PM, jim deleskie

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-24 Thread Christopher Morrow
On Sat, May 23, 2015 at 9:12 PM, jim deleskie deles...@gmail.com wrote: However, the trusted network initiative might be a good approach to start influencing operators to apply anti-spoofing mechanisms. explain how you think the 'trusted network initiative' matters in the slightest? -chris

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Harlan Stenn
Just to ask, what is the expected effect on DDoS attacks if folks implemented BCP38? How does the cost of implementing BCP38 compare to the cost of other solution attempts? H

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Scott Weeks
--- st...@ntp.org wrote: From: Harlan Stenn st...@ntp.org Just to ask, what is the expected effect on DDoS attacks if folks implemented BCP38? --- A moot point these days. After all the years it has been out (15 years: https://tools.ietf.org/html/bcp38

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Ramy Hashish
Yes Harlan, you are absolutely right, even if this won't stop the botnet-based DDoS attacks, but at least will significantly decrease the volume/frequency of the volume based attacks. On the other side, the DDoS protection now become a business where all-tiers ISPs make money of, and those ISPs

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Roland Dobbins
On 24 May 2015, at 3:14, Scott Weeks wrote: Those that care (NANOG type folks) already have deployed it and those that don't care have not and will not. Concur 100%. https://app.box.com/s/r7an1moswtc7ce58f8gg --- Roland Dobbins rdobb...@arbor.net

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread jim deleskie
anything they don't need to, to get the bit to you. -jim On Sat, May 23, 2015 at 6:33 PM, Ramy Hashish ramy.ihash...@gmail.com wrote: Yes Harlan, you are absolutely right, even if this won't stop the botnet-based DDoS attacks, but at least will significantly decrease the volume/frequency

[SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Ramy Hashish
aggressive effect on the volume of the DDoS attacks, and will eventually steer the mindset of the enterprises towards hosting the most critical applications/services in a well geographically-dispersed cloud and increasing the surface area using anycast then relatively decreasing the attack volume

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread Roland Dobbins
On 23 May 2015, at 19:56, Ramy Hashish wrote: I am little bit confused; aren't the application firewalls -either integrated in a NGFW or a UTM- the responsible for mitigating application layer attacks? https://app.box.com/s/a3oqqlgwe15j8svojvzl https://app.box.com/s/4h2l6f4m8is6jnwk28cg

Re: [SECURITY] Application layer attacks/DDoS attacks

2015-05-23 Thread jim deleskie
aggressive effect on the volume of the DDoS attacks, and will eventually steer the mindset of the enterprises towards hosting the most critical applications/services in a well geographically-dispersed cloud and increasing the surface area using anycast then relatively decreasing the attack

Re: ddos attacks

2013-12-20 Thread Saku Ytti
On (2013-12-20 03:24 +), Dobbins, Roland wrote: I think ipv4 udp is just going to become operationally deprecated. Too much pollution. It is really an epic amount of trash / value ratio in ipv4 udp. This isn't a realistic viewpoint. What are realistic options? a) QUIC and

Re: ddos attacks

2013-12-20 Thread Dobbins, Roland
On Dec 20, 2013, at 3:27 PM, Saku Ytti s...@ytti.fi wrote: c) ACL/RPF in significant portion of access ports in whole world - i'm guessing significant portion of access ports are on autopilot with no one to change their configs, so probably not practical. d) The current state of

Re: ddos attacks

2013-12-19 Thread Tore Anderson
* James Braunegg Of course for any form of Anti DDoS hardware to be functional you need to make sure your network can route and pass the traffic so you can absorb the bad traffic to give you a chance cleaning the traffic. So in order for an Anti-DDoS appliance to be functional the network

Re: ddos attacks

2013-12-19 Thread Adrian M
Hi, You can also test WANGUARD, http://www.andrisoft.com/ for DDoS detection and BGP triggered blackholing. On Thu, Dec 19, 2013 at 11:32 AM, Eugeniu Patrascu eu...@imacandi.netwrote: Hi, You can also take a look at http://www.packetdam.com/ for DDoS protection. Eugeniu On Thu, Dec 19,

Re: ddos attacks

2013-12-19 Thread John Kristoff
On Wed, 18 Dec 2013 15:12:28 -0800 cb.list6 cb.li...@gmail.com wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. It is the simplest solution that is proactive. I understand your willingness to do this, but I'd strongly advise you to rethink such a strategy.

Re: ddos attacks

2013-12-19 Thread Dobbins, Roland
On Dec 19, 2013, at 3:53 PM, Tore Anderson t...@fud.no wrote: So in order for an Anti-DDoS appliance to be functional the network needs to be able to withstand the DDoS on its own. How terribly useful. Due to the nature of network infrastructure devices and TCP/IP, it's quite necessary that

Re: ddos attacks

2013-12-19 Thread Nick Hilliard
On 19/12/2013 13:17, Dobbins, Roland wrote: This is a base requirement for any network operator, without exception. in fact, this comes down to cost / benefit / application analysis, without exception. Many hosting profiles don't require this sort of anti-DDoS kit. In many cases it's far

Re: ddos attacks

2013-12-19 Thread Dobbins, Roland
On Dec 19, 2013, at 8:40 PM, Nick Hilliard n...@foobar.org wrote: Many hosting profiles don't require this sort of anti-DDoS kit. My post had nothing to do with 'anti-DDoS kit'. I'm sure mitigation boxes like this serve well in many situations if the cost / benefit justifies the

Re: ddos attacks

2013-12-19 Thread Nick Hilliard
On 19/12/2013 14:08, Dobbins, Roland wrote: My post had nothing to do with 'anti-DDoS kit'. hmm, re-reading it, your post was contextually ambiguous and I read it in a different way to the way that apparently you meant. but yes, if you're doing onsite ddos scrubbing, you needs lotsabandwidth.

Re: ddos attacks

2013-12-19 Thread Lee Howard
On 12/18/13 8:03 PM, Jon Lewis jle...@lewis.org wrote: On Wed, 18 Dec 2013 valdis.kletni...@vt.edu wrote: On Wed, 18 Dec 2013 15:12:28 -0800, cb.list6 said: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. It is the simplest solution that is proactive. What

Re: ddos attacks

2013-12-19 Thread Edward Lewis
On Dec 18, 2013, at 18:12, cb.list6 wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. It is the simplest solution that is proactive. Recently it's been said that when a protocol is query/response (like DNS), willingly suppressing responses might be as

Re: ddos attacks

2013-12-19 Thread Jon Lewis
On Thu, 19 Dec 2013, Lee Howard wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. It is the simplest solution that is proactive. What are the prospects for ipv6 UDP not suffering the same fate? Roughly 0%, but there's so little v6 traffic compared to v4,

Re: ddos attacks

2013-12-19 Thread cb.list6
On Thu, Dec 19, 2013 at 8:18 AM, Edward Lewis ed.le...@neustar.biz wrote: On Dec 18, 2013, at 18:12, cb.list6 wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. It is the simplest solution that is proactive. Recently it's been said that when a protocol is

Re: ddos attacks

2013-12-19 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm really surprised no one has mentioned Akamai/Prolexic, especially since their recent marriage. If someone has already mentioned it: Apologies. - - ferg On 12/19/2013 4:08 AM, Adrian M wrote: Hi, You can also test WANGUARD,

Re: ddos attacks

2013-12-19 Thread den...@justipit.com
Ferguson fergdawgs...@mykolab.com To: nanog@nanog.org Subject: ddos attacks Date: Thu, Dec 19, 2013 2:35 PM -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm really surprised no one has mentioned Akamai/Prolexic, especially since their recent marriage. If someone has already mentioned

Re: ddos attacks

2013-12-19 Thread den...@justipit.com
Ferguson fergdawgs...@mykolab.com To: nanog@nanog.org Subject: ddos attacks Date: Thu, Dec 19, 2013 2:35 PM -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I'm really surprised no one has mentioned Akamai/Prolexic, especially since their recent marriage. If someone has already mentioned

Re: ddos attacks

2013-12-19 Thread Eugeniu Patrascu
On Thu, Dec 19, 2013 at 10:30 PM, den...@justipit.com den...@justipit.comwrote: Just about every security, network and ADC vendor out there is claiming anti-dos capabilities. Be careful when going that route and do your own validation. I suggest looking at Radware and Arbor (both leaders in

Re: ddos attacks

2013-12-19 Thread den...@justipit.com
further offlist. Cheers Dennis Sent from my Sprint phone. - Reply message - From: Eugeniu Patrascu eu...@imacandi.net To: den...@justipit.com den...@justipit.com Cc: fergdawgs...@mykolab.com, NANOG list nanog@nanog.org Subject: ddos attacks Date: Thu, Dec 19, 2013 3:51 PM On Thu, Dec 19

Re: ddos attacks

2013-12-19 Thread den...@justipit.com
further offlist. Cheers Dennis Sent from my Sprint phone. - Reply message - From: Eugeniu Patrascu eu...@imacandi.net To: den...@justipit.com den...@justipit.com Cc: fergdawgs...@mykolab.com, NANOG list nanog@nanog.org Subject: ddos attacks Date: Thu, Dec 19, 2013 3:51 PM On Thu, Dec 19

Re: ddos attacks

2013-12-19 Thread Dobbins, Roland
On Dec 19, 2013, at 10:40 PM, Nick Hilliard n...@foobar.org wrote: hmm, re-reading it, your post was contextually ambiguous and I read it in a different way to the way that apparently you meant. It was quite clear what was meant, even without looking at the linked presentation, which

Re: ddos attacks

2013-12-19 Thread Dobbins, Roland
On Dec 19, 2013, at 6:12 AM, cb.list6 cb.li...@gmail.com wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. QoS is a very poor mechanism for remediating DDoS attacks. It ensures that programmatically-generated attack traffic will 'squeeze out' legitimate

Re: ddos attacks

2013-12-19 Thread cb.list6
On Dec 19, 2013 4:25 PM, Dobbins, Roland rdobb...@arbor.net wrote: On Dec 19, 2013, at 6:12 AM, cb.list6 cb.li...@gmail.com wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. QoS is a very poor mechanism for remediating DDoS attacks. It ensures

Re: ddos attacks

2013-12-19 Thread Scott Weeks
--- cb.li...@gmail.com wrote: On Dec 19, 2013 4:25 PM, Dobbins, Roland rdobb...@arbor.net wrote: On Dec 19, 2013, at 6:12 AM, cb.list6 cb.li...@gmail.com wrote: I am strongly considering having my upstreams to simply rate limit ipv4 UDP. QoS is a very poor mechanism for remediating DDoS

Re: ddos attacks

2013-12-19 Thread Tore Anderson
* Dobbins, Roland Once again, nothing in my post said or referred to bandwidth; The post of mine, to which you replied, did. Perhaps if you had taken your own advice quoted below when replying to me, Nick wouldn't have been contextually confused. Tore In future, it might be a good idea to

Re: ddos attacks

2013-12-19 Thread Dobbins, Roland
On Dec 20, 2013, at 4:39 AM, cb.list6 cb.li...@gmail.com wrote: Not answering any of that. But thanks for asking. I wasn't asking those questions in order to elicit information from you, but rather as food for thought as you work through these issues. I think ipv4 udp is just going to

Re: ddos attacks

2013-12-18 Thread Dan White
Can anyone recommend a vendor solution for DDOS mitigation? We are looking for a solution that detects DDOS attacks from sflow information and automatically announces BGP /32 blackhole routes to our upstream providers, or a similar solution. Thank You. On 08/05/13 21:09 +1000, Ahad Aboss wrote

Re: ddos attacks

2013-12-18 Thread Paul Stewart
:36 AM, Dan White dwh...@olp.net wrote: Can anyone recommend a vendor solution for DDOS mitigation? We are looking for a solution that detects DDOS attacks from sflow information and automatically announces BGP /32 blackhole routes to our upstream providers, or a similar solution. Thank You. On 08

Re: ddos attacks

2013-12-18 Thread Peter Phaal
recommend a vendor solution for DDOS mitigation? We are looking for a solution that detects DDOS attacks from sflow information and automatically announces BGP /32 blackhole routes to our upstream providers, or a similar solution. Thank You. On 08/05/13 21:09 +1000, Ahad Aboss wrote: Scott

Re: ddos attacks

2013-12-18 Thread cb.list6
On Aug 2, 2013 10:31 AM, sgr...@airstreamcomm.net wrote: I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive and block as many addresses as possible or null0 traffic to the effected host until

RE: ddos attacks

2013-08-05 Thread Ahad Aboss
in this space who provide a self healing/self defending system. Cheers Ahad -Original Message- From: sgr...@airstreamcomm.net [mailto:sgr...@airstreamcomm.net] Sent: Friday, 2 August 2013 11:37 PM To: nanog@nanog.org Subject: ddos attacks I’m curious to know what other service providers are doing

ddos attacks

2013-08-02 Thread sgraun
I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive and block as many addresses as possible or null0 traffic to the effected host until it stops or do you block certain ports to prevent them

Re: ddos attacks

2013-08-02 Thread Valdis . Kletnieks
On Fri, 02 Aug 2013 08:37:21 -0500, sgr...@airstreamcomm.net said: I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. The answers will vary from nothing to extensive network planning and contracts with mitigation

Re: ddos attacks

2013-08-02 Thread Patrick W. Gilmore
On Aug 02, 2013, at 09:37 , sgr...@airstreamcomm.net wrote: I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive and block as many addresses as possible or null0 traffic to the effected

Re: ddos attacks

2013-08-02 Thread Jared Mauch
On Aug 2, 2013, at 10:38 AM, Patrick W. Gilmore patr...@ianai.net wrote: On Aug 02, 2013, at 09:37 , sgr...@airstreamcomm.net wrote: I’m curious to know what other service providers are doing to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive

Re: ddos attacks

2013-08-02 Thread Mark Andrews
to alleviate/prevent ddos attacks from happening in your network. Are you completely reactive and block as many addresses as possible or null0 traffic to the effected host until it stops or do you block certain ports to prevent them. What's the best way people are dealing with them? #1: Ensure

Re: DDoS Attacks Cause of Game Servers

2013-01-31 Thread Stephane Bortzmeyer
On Thu, Jan 31, 2013 at 11:23:11AM +0330, Shahab Vahabzadeh sh.vahabza...@gmail.com wrote a message of 55 lines which said: Those ip addresses I send were only sample, its 5 page :D and not only those addresses. Because the attacker attacks when they have a new opponent. They DoS it long

Re: DDoS Attacks Cause of Game Servers

2013-01-31 Thread Fredrik Holmqvist / I2B
Hi. The IPs you see is the exploited gameservers, so just contact them, and send them the link below. There is a workaround for it: http://rankgamehosting.ru/index.php?showtopic=1320 We have had problem with this in the past. Usually we get abuse complaints from the admin of the game

Re: DDoS Attacks Cause of Game Servers

2013-01-31 Thread John Kristoff
On Thu, 31 Jan 2013 10:34:29 +0330 Shahab Vahabzadeh sh.vahabza...@gmail.com wrote: Attacks takes only 20 or 30 minutes and it happens only 4 times in two days. I could'nt capture any packet but this is out put of my show ip accounting that time: Attacks on gaming systems or at the gamers

Re: DDoS Attacks Cause of Game Servers

2013-01-31 Thread Jeroen Massar
On 2013-01-31 08:04 , Shahab Vahabzadeh wrote: Hi everybody, Last two days I was under an interesting attack which comes from multiple sources to three of my ADSL users destination. You say that it comes from multiple sources to 3 of your DSL users. The below source/dest though shows that the

Re: DDoS Attacks Cause of Game Servers

2013-01-31 Thread Jeroen Massar
On 2013-01-31 08:53 , Shahab Vahabzadeh wrote: Those ip addresses I send were only sample, its 5 page :D and not only those addresses. And you are looking to target 128.141.X.Y its mine 128.141.0.0/16 is CERN in Switzerland. Thus not yours, but owned(*) by n...@cern.ch. (unless you work

DDoS Attacks Cause of Game Servers

2013-01-30 Thread Shahab Vahabzadeh
Hi everybody, Last two days I was under an interesting attack which comes from multiple sources to three of my ADSL users destination. The attack make router to ran out of CPU and we had to reload it to solve. I ask those three users and they said we are only game players and all of them were

Re: DDoS Attacks Cause of Game Servers

2013-01-30 Thread clayton
I see these type of reflection/amplification attacks pretty frequently. Some games (mostly older games) are exploitable in this manner. The attacker sends a short spoofed request, and the game server sends back a huge chunk of data aimed at you. The chances of you finding the actual source are

Re: DDoS Attacks Cause of Game Servers

2013-01-30 Thread Shahab Vahabzadeh
Those ip addresses I send were only sample, its 5 page :D and not only those addresses. And you are looking to target 128.141.X.Y its mine and I change it because of mailing list, maybe attackers are here. You must check the sources not destination. Thanks On Thu, Jan 31, 2013 at 11:06 AM, Jeroen

Re: VIDEO: Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape – NYC 12/5 #DDoS

2012-12-16 Thread Joly MacFie
It has been pointed out to me ( Thanks Yuri!) that I screwed up the url for the AMARA translation page for this, it is http://www.universalsubtitles.org/en-gb/videos/lvgGlpwZR0lA/info/mitigating-ddos-attacks-best-practices-for-an-evolving-threat-landscape/#video If I may say a bit more.about

VIDEO: Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape – NYC 12/5 #DDoS

2012-12-15 Thread Joly MacFie
/lvgGlpwZR0lA/info/mitigating-ddos-attacks-best-practices-for-an-evolving-threat-landscape/- it's possible to just contribute as much or as little as you have time to do. ** joly posted: The Internet Society's New York Chapter (ISOC-NY) and the New York Technology Council (NYTECH) joined

Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape – NYC 12/5

2012-11-28 Thread Joly MacFie
Technology Council (NYTECH http://nytech.org/) will join the Public Interest Registry (PIR http://www.pir.org/) in presenting a midday symposium “Mitigating DDoS Attacks: Best Practices for an Evolving Threat Landscape http://www.pir.org/why/security/ddos” in New York City on December 5 2012. Participating

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread khatfield
DoS/DDoS Attacks Sent: Sep 9, 2010 12:13 AM Brandon Galbraith wrote: http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-hitmen-to-take-down-internet-pirates-20100907-14ypv.html http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-hitmen-to-take-down

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread Beavis
man.. this guy is retarded.. good luck posing your company, face and such. lol

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread Jeffrey Lyon
He may get some business out of it, now that he has effectively put out a DDoS for hire ad. Jeff On Thu, Sep 9, 2010 at 8:56 PM, Beavis pfu...@gmail.com wrote: man.. this guy is retarded.. good luck posing your company, face and such. lol -- Jeffrey Lyon, Leadership Team

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread Dobbins, Roland
On Sep 9, 2010, at 11:43 PM, Jeffrey Lyon wrote: He may get some business out of it, now that he has effectively put out a DDoS for hire ad. The relevant Indian authorities have been notified - my guess is that he'll soon be receiving some interesting visitors. ;

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread khatfield
to gain some publicity. *shrug* --Original Message-- From: Jeffrey Lyon To: Beavis Cc: nanog@nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 11:43 AM He may get some business out of it, now that he has effectively put out a DDoS for hire ad. Jeff On Thu, Sep

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread Eric Katanich
to gain some publicity. *shrug* --Original Message-- From: Jeffrey Lyon To: Beavis Cc: nanog@nanog.org Subject: Re: Copyright Enforcement DoS/DDoS Attacks Sent: Sep 9, 2010 11:43 AM He may get some business out of it, now that he has effectively put out a DDoS for hire ad. Jeff On Thu, Sep

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-09 Thread Suresh Ramasubramanian
On Fri, Sep 10, 2010 at 1:29 AM, khatfi...@socllc.net wrote: Kind of a shame..  We are likely already tracking his botnets so I almost welcome it as well. Out of curiosity, I did pull some stats over the last 60 days and we have seen more attacks originating from the India area than we

Copyright Enforcement DoS/DDoS Attacks

2010-09-08 Thread Brandon Galbraith
with this in the wild? I wasn't aware DoS/DDoS attacks were suddenly legal. -- Brandon Galbraith Voice: 630.492.0464

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-08 Thread Suresh Ramasubramanian
-hires-cyber-hitmen-to-take-down-internet-pirates-20100907-14ypv.html http://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-hitmen-to-take-down-internet-pirates-20100907-14ypv.htmlHas anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were suddenly legal

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-08 Thread Michael Painter
anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were suddenly legal. It's gotta' be tough reading that when you're in the slammer, eh? http://www.theregister.co.uk/2010/05/25/second_scientology_ddoser_jailed/

Re: Copyright Enforcement DoS/DDoS Attacks

2010-09-08 Thread Jeffrey Lyon
://www.smh.com.au/technology/technology-news/film-industry-hires-cyber-hitmen-to-take-down-internet-pirates-20100907-14ypv.htmlHas anyone dealt with this in the wild? I wasn't aware DoS/DDoS attacks were suddenly legal. It's gotta' be tough reading that when you're in the slammer, eh? http