nanog mailing list archives

Re: UDP Amplification DDoS - Help!


From: "Roland Dobbins" <rdobbins () arbor net>
Date: Tue, 09 Feb 2016 09:54:10 +0700

On 9 Feb 2016, at 9:50, mike.lyon () gmail com wrote:

Sounds like there is a compromised host downstream of the 1G that is reporting back it's source IP and that is why changing the IP doesn't help.

It's much more likely that the attacker is just following the DNS changes.

-----------------------------------
Roland Dobbins <rdobbins () arbor net>


Current thread: