Re: DDoS Attack in Progress.

["Steve Church" <nanog () headcandy org>]

Beavis aka John Lopez:
I, for one, am glad you're interested in stopping the abuse at its source.
Thank you.

Steve Linford:
> why not ACL the source at your router or at whatever device is being
(packeted).
Mr. Lopez is contributing to the welfare of the net as a whole by addressing
the cause, rather than applying a bandage locally to lessen the symptom.  I
sincerely hope your dismissive advice is not characteristic of Spamhaus
policy regarding abused hosts, considering the mission statement at the top
of your homepage.

Steve Church


On Sat, Oct 11, 2008 at 4:05 AM, Steve Linford <linford () spamhaus org> wrote:

> On 10 Oct 2008, at 20:46, Beavis wrote:
>
>  Hi All,
> >  DoS attack in progress, any upstream info for these guys? their
> > phone number doesn't respond.
> >
> > inetnum:         88.247.0.0 - 88.247.79.255
> > netname:         TurkTelekom
> > descr:           TT ADSL-alcatel static_ulus
> > country:         tr
>
> The Spamhaus folk on this list have the address of TurkTelekom's chief
> security/abuse guy who would take take of this, but we would not be inclined
> to give his address to someone identifying themselves as "Beavis" with a
> gmail address. Can you elaborate on who you are, what's being DoSsed (a
> router, an http server, a mail server?), and whether you can ACL the source
> (since you know the source is in 88.247.0.0/17, why not ACL the source at
> your router or at whatever device is being DoSsed).
>
>  Steve Linford
>  The Spamhaus Project
>  http://www.spamhaus.org