Hi All, Did anyone get any info they can share (off list if preferred) about yesterdays attack, we had many JANET services affected.
Also any UK (London specifically) Level3 cusotmers here that had any issues yesterday? During the JANET DDoS attackes we had some weird perfrormance issues on our L3 link, its a far flung guess but I wondered if L3 were carrying a good portion of that DDoS traffic, and "near" our peering with them. Only on our L3 feed we saw packet loss peaking between 09:00 and 11:00 yesterday but more weirdly though we had a much higher than usual number of BGP updates from L3. Between 09:00 and 11:00 we received about 10886 updates, from TaTa and Cogent for the same time period respectively 3076 and 5171. Also when I looked about 18:00 yesterday 10% of the full table routes received from L3 had an age of less than 1 day, so 10% of the global table has flapped via Level3 for us. I also saw something similar on RIPE BGPplay, they saw a spike in updates from Level3 at 09:20 to be exact (we don't have such presice measurements internally). Its all a bit wooly to pull anything together from than but it seems like "something" was up and it was worst around the time Janet were being DDoSed. Cheers, James.
