nanog mailing list archives

Re: Ransom DDoS attack - need help!


From: "Roland Dobbins" <rdobbins () arbor net>
Date: Thu, 10 Dec 2015 13:51:45 +0700

On 10 Dec 2015, at 13:21, Joe Morgan wrote:

We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted.

Suggest you take a look at the presos I posted earlier and look into S/RTBH, flowspec, some limited QoS, and some preemptive ACLs so that you aren't forced into completing the DDoS.

-----------------------------------
Roland Dobbins <rdobbins () arbor net>


Current thread: