North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: DOS attack assistance?

  • From: Darrell Hyde
  • Date: Wed Nov 26 06:50:13 2008

>One of my customers, a host at 64.8.105.15, is feeling a "bonus"
>~130kpps from 88.191.63.28.  I've null-routed the source, though our
>Engine2 GE cards don't seem to be doing a proper job of that,
>unfortunately.  The attack is a solid 300% more pps than our aggregate
>traffic levels.

Null routing the source isn't going to stop the inbound packets from reaching the target of
the attack. All that's going to do is blackhole packets back to the attacker from anyone hopping
through the router carrying the null route.

- Darrell