North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Level3 routing issues?

  • From: Gary Coates
  • Date: Sat Jan 25 08:34:31 2003


Appears to relate to this cert advisory

http://www.cert.org/advisories/CA-1996-01.html

We have it totally blocked on our network but the routers are working over time just rejecting packets.

The only way to stop it is to stop MySQL or kill the hosts network connection.




[email protected] wrote:
It is global.

01:42:04.040462 194.87.13.21.1812 > x.x.x.x.1434:  rad-account-req
376 [id 1] Attr[  User User User User User User User User User User User
User User User User User User User User User User User User User User User
User User User User User User User [|radius]

That is the traffic...


On Sat, 25 Jan 2003, hc wrote:


I am on Verizon-GNI via Qwest and Genuity and seeing the same problem as
well.

-hc

Joel Perez wrote:


I am also seeing increased traffic on my network. It has gotten so bad for one of my edge routers that i cant telnet into it.
But i am on Qwest and GBLX.

	-----Original Message-----
	From: Alex Rubenstein [mailto:[email protected]]
	Sent: Sat 1/25/2003 1:04 AM
	To: hc
	Cc: [email protected]
	Subject: Re: Level3 routing issues?





	I dunno about that. But, I am seeing, in the last couple hours, all kinds
	of new traffic.

	like, customers who never get attacked or anything, all of a sudden:

	        http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.html


	We are seeing this on ports all across out network -- nearly 1/2 our ports
	are in delta alarm right now.

	Anyone else?

	I will dig more to look at the traffic.




	On Sat, 25 Jan 2003, hc wrote:

	>
	> Anyone seeing routing problems with Level3 at this hour? I just
	> witnessed tons of prefixes behind level3's network withdraw. Any
	> information on what is happening (if you know) would be great. Thanks!
	>
	> -hc
	>
	>
	>

	-- Alex Rubenstein, AR97, K2AHR, [email protected], latency, Al Reuben --
	--    Net Access Corporation, 800-NET-ME-36, http://www.nac.net   --










--
____________________________________________________
Message scanned for viruses and dangerous content by
<http://www.newnet.co.uk/av/> and believed to be clean