RE: ddos attack in progress... help needed

["Hassan, Shehzad" <shehzad.hassan () bell ca>]

Reporting Security Incidents (PSIRT Advisories)
http://www.cisco.com/warp/public/707/sec_incident_response.shtml#Incidents
If you are under active security attack or believe that you are about to be
attacked, contact the Cisco Technical Assistance Center at +1 408 526 7209
or +1 800 553 2447 or by any of the means listed under "Contact Summary" in
this document.

SH


-----Original Message-----
From: Rodney Joffe [mailto:rjoffe () centergate com]
Sent: Friday, May 03, 2002 8:15 PM
To: NANOG
Subject: ddos attack in progress... help needed



Hello folks,

We're undergoing a ddos attack on one of our machines. Its quite
manageable so far - 28 source IPs, many of them cable modems. But its
the first we've ever suffered, and before we get too deep in, I'd
appreciate pointers to the appropriate law enforcement parties to
contact so we can get to the root eventually. Offline is fine.

If there's any value, I'm happy to provide the list. Sustained rate from
each machine is around 2mbits per 5 min snapshot.
-- 
Rodney Joffe
CenterGate Research Group, LLC.
http://www.centergate.com
"Technology so advanced, even we don't understand it!"(SM)