Re: DoS Attacks

[Avleen Vig <lists-nanog () silverwraith com>]

On Tue, Oct 07, 2003 at 11:45:35PM -0400, Brian Bruns wrote:
> So here I am, asking if anyone here has any advice on dealing with these
> issues in the future?  Its painfully apparent noone takes these situations
> seriously enough.  What should we do when we are put in a position like
> this?  Just sit back and hope it goes away itself?

You were lucky to know where it was coming from.
What you depends on what you know.
You knew the sources are small and you knew where they were. You did the
right thing by contacting FSU, and then their upstream.
If either was unresponsive, they are being extremely neglegent.
I'm one of the few who still believes that immediate 24/7 response to
security problems should be a requirement for permanent internet
connectivity.

If you don't know the source, talking to your own upstream to see if
there is anything they can do is a good first move. Most decent places
will at least TRY and help you out.

But realise that sometimes you just need to ride it out.