nanog mailing list archives

Re: Strange IPSEC traffic

From: "Dobbins, Roland via NANOG" <nanog () nanog org>
Date: Tue, 14 Nov 2023 04:54:39 +0000


On Nov 14, 2023, at 00:12, Shawn L via NANOG <nanog () nanog org> wrote:

The destination address is always one of our customer's ip addresses.


Attackers will sometimes use synthetic ESP, AH, GRE, or other protocols in DDoS attacks, because organizations often 
only think about TCP/UDP/ICMP in terms of ACLs, DDoS defense mechanisms, etc.

--------------------------------------------

Roland Dobbins <roland.dobbins () netscout com>

Current thread:

Strange IPSEC traffic Shawn L via NANOG (Nov 13)
- Re: Strange IPSEC traffic Adrian Minta (Nov 13)
  - Re: Strange IPSEC traffic Maurice Brown (Nov 13)
    - Re: Strange IPSEC traffic Sabri Berisha (Nov 13)
  - Re: Strange IPSEC traffic Tom Beecher (Nov 14)
- RE: Strange IPSEC traffic Mike Lewinski via NANOG (Nov 13)
- Re: Strange IPSEC traffic Dobbins, Roland via NANOG (Nov 13)
- Re: Strange IPSEC traffic Niels Bakker (Nov 14)