nanog mailing list archives
Re: Growing DoS attacks
From: Avleen Vig <lists-nanog () silverwraith com>
Date: Wed, 16 Jan 2002 22:56:59 +0000 (GMT)
On Wed, 16 Jan 2002, Paul Froutan wrote:
Hello all, Can some of you with larger networks let me know about the volume of the DoS attacks you have experienced lately? Our experience has been that the volume (not just occurrence) is going up significantly and I'm curious on the size of attacks that people are experiencing. For reference, while a year or two ago we used to get 50-100 meg attacks, now we're getting 500+ megs.
I don't run a large network, but I am curious and will help where possible. Are you able to say what kind of DoD attacks are taking place? ICMP Floods? TCP Floods? UDP Floods? A mixture? If you feel the src addr is spoofed, have you taken a packet capture and looked for similarities in the packets? I read a paper about 5 months ago where someone had worked very hard at analysing the differences in packets generated by various DoS agents. Maybe you should attempt to trace them back? If they are Smurf attacks, I may be able to help more, let me know. -- Avleen Vig Network Security Officer Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf
Current thread:
- Re: Growing DoS attacks, (continued)
- Re: Growing DoS attacks Avleen Vig (Jan 16)
- Re: Growing DoS attacks Barb Dijker (Jan 16)
- Re: Growing DoS attacks Jared Mauch (Jan 16)
- Re: Growing DoS attacks Vincent Gillet (Jan 17)
- Message not available
- Re: Growing DoS attacks Vincent Gillet (Jan 17)
- Re: Growing DoS attacks Jared Mauch (Jan 17)
- Re: Growing DoS attacks Jared Mauch (Jan 16)
- Re: Growing DoS attacks Joe Abley (Jan 17)
- Re: Growing DoS attacks Vincent Gillet (Jan 17)
- Re: Growing DoS attacks Joe Abley (Jan 17)
- Re: Growing DoS attacks Barb Dijker (Jan 17)
- Re: Growing DoS attacks Tom Sands (Jan 17)
- Re: Growing DoS attacks Paul Timmins (Jan 16)
- Re: Growing DoS attacks Jared Mauch (Jan 16)
- Re: Growing DoS attacks Avleen Vig (Jan 16)