nanog mailing list archives

Re: Inter-provider communications (Re: nobody @home)


From: "Matthew S. Hallacy" <poptix () POPTIX NET>
Date: Mon, 22 Jan 2001 01:32:10 -0600 (CST)



Well, in light of all the gloom I would like to say that I had a good
experience with exodus/doubleclick, my network was recently the victim of
a smurf attack, one of the amps was doubleclick.net, I contacted exodus
about it and they (within an hour) put me into contact with
doubleclick.net who had someone call me, I was able to walk the person on
the phone through fixing the problem, and they are no longer a smurf amp.

It's nice to have a few good experiences..

FYI, I am not a customer of Exodus in any way.

                        Matthew S. Hallacy
                        XtraTyme Technologies
                        Systems/Network Administrator

On Sun, 21 Jan 2001, Dan Hollis wrote:

Well, let's take a better example, smurf amps.

I have some personal horror stories about running around in circles
getting tier1s to turn off their smurf amps originating from their own
routers or customers. Eg tier1 router was a smurf amp, it was smurfing, it
could be easily verified to smurf, but they would not disable the smurf
amp because it would have a "negative impact" on their customers. The
fact it was being actively used as a smurf amp didnt seem to matter to them.

This was in fact a case of "just flip a switch and turn off the attack".

I'm sure others on this list have their share of horror stories as well.

The hoops the public had to jump through the past couple years to get
tier1s to turn off their smurf amps is mind boggling. And there are
tier1s who are *still* actively running smurf amps in their cores.

I'm actually suprised noone has filed lawsuits over this. Or maybe someone
did and I missed it.

-Dan







Current thread: