[nsp-sec-jp] DDoS to 129.21.13.164

[Taka Mizuguchi]

NSP-SEC-JP$B3F0L!"(B

NSP-SEC$B$h$$#r!"%"%?%C%/$N>pJs$rE>Aw$7$^$9!#(B
$B$b$7!"3F%M%C%H%o!<%/$G!"(B129.21.13.164/32$B$KBP$7$F0[>o$J%H%i%U%#%C%/(B
$B$r7WB,$7$?$i!"Aw?.85$r$43NG'$/$@$5$$!#Aw?.%[%9%H$N%j%9%H$rLc$C$?$i(B
$BE>Aw$7$^$9!#(B

-----
$BBg3X$N%5!<%P$,#2F|A0!JF|K\;~4V(B23$BF|!K$h$j%"%?%C%/$r<u$1$F$$$k!#(B
129.21.13.164/32$B$KBP$9$k(BFlow$B$,LdBj$G$9!#%M%C%H%o!<%/$N%j%s%/$NIi2Y$r(B
$B2<$2$k$?$a$K!"!J>eN.$N!K(BLevel3$B$N%M%C%H%o!<%/$G(BSinkhole Routing$B$r9T$C(B
$B$F$$$^$9!#%[%9%H$N(BSysadmin$B$+$i(BFirewall$B$N%m%0$r$b$i$$<!Bh!"Aw?.$7$F$$(B
$B$k%[%9%H$N%j%9%H$rDs6!$7$^$9!#%9%-%c%K%s%0%5!<%P8!CN$N%H%i%U%#%C%/(B
$B$@$1$G$O$J$5$=$&$G$9!D!#(B


Forwarded by Taka Mizuguchi <taka ＠ ntt.net>
----------- nsp-security Confidential --------

All -

Our on-campus scanning server has been under attack for the past two
days - flows to 129.21.13.164/32 are bad. We have a sinkhole route in
place at Level3 to get the load off our network link. I'll be
providing a list of hosts when I get the complete firewall log
from the sysadmin of the host. Seems to not be the only
scanning-server-directed Storm traffic flying about...

-----
Taka Mizuguchi
taka ＠ ntt.net