nanog mailing list archives
Re: isprime DOS in progress
From: Harald Koch <chk () pobox com>
Date: Wed, 21 Jan 2009 13:24:22 -0500
Graeme Fowler wrote:
On Tue, 2009-01-20 at 14:55 -0600, Todd T. Fries forwarded:
I've been seeing a lot of noise from the latter two addresses after switching on query logging (and finishing an application of Team Cymru's excellent template) so I decided to DROP traffic from the addresses (with source port != 53) at the hosts in question. Well, blow me down if they didn't completely stop talking to me. Four dropped packets each, and they've gone away.
I've seen that behaviour in the past, but not this time?I've seen a few of these attacks bouncing off my nameservers recently, and when I add "DROP" rules to my firewall, the incoming traffic disappears soon after. But the most recent set (66.230.160.1 and 66.230.128.15) are still hammering away...
-- Harald
Current thread:
- Any ATT DNS admins out there? Mike Lyon (Jan 09)
- isprime DOS in progress Todd T. Fries (Jan 20)
- Re: isprime DOS in progress Graeme Fowler (Jan 21)
- Re: isprime DOS in progress Phil Rosenthal (Jan 21)
- Re: isprime DOS in progress Aaron Hopkins (Jan 21)
- Re: isprime DOS in progress Graeme Fowler (Jan 21)
- RE: isprime DOS in progress Justin Krejci (Jan 21)
- Re: isprime DOS in progress, and Re: DNS Amplification attack? Dale Carstensen (Jan 21)
- Re: isprime DOS in progress Graeme Fowler (Jan 21)
- Re: isprime DOS in progress Harald Koch (Jan 21)
- Re: isprime DOS in progress Bjørn Mork (Jan 22)
- Re: isprime DOS in progress Phil Rosenthal (Jan 23)
- RE: isprime DOS in progress Steven Lisson (Jan 23)
- Re: isprime DOS in progress Joe Abley (Jan 23)
- RE: isprime DOS in progress Luke Sheldrick (Jan 23)
- Re: isprime DOS in progress Chris McDonald (Jan 23)
- Re: isprime DOS in progress Noel Butler (Jan 23)
- Are we really this helpless? (Re: isprime DOS in progress) Seth Mattinen (Jan 23)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Jeffrey Lyon (Jan 23)
- Re: Are we really this helpless? (Re: isprime DOS in progress) Gadi Evron (Jan 23)
- isprime DOS in progress Todd T. Fries (Jan 20)