[nsp-sec] Anyone else seeing a HUGE increase in TCP/1935 from Limelight Networks

[Kevin Oberman]

> Date: Tue, 17 Jun 2008 12:53:11 +0000
> From: John Fraizer <john at op-sec.us>
> Sender: nsp-security-bounces at puck.nether.net
> 
> ----------- nsp-security Confidential --------
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> Definitely progress. :)
> 
> The best part of the day on Monday was being able to tell the
> pointy-heads that Tiger Woods was responsible for the 3Gb/s DDoS on
> the network. :) The "incident" went a long way towards getting me the
> deep packet inspection capabilities I want as well. :)
> 
> John

No. Tiger Woods, Rocco Mediate, and the U.S. Open were responsible for
evidence that your network was not adequately provisioned for the
unexpected demands for the "real world". No malware or miscreants
involved...just demand for bandwidth which exceeded normal parameters by
a wide margin.

My point in not to argue your choice of words (though I do), but to
point out that this sort of thing is going to be a huge problem as time
goes on. You need to have significant over-provisioning (not good
for the bottom line), block the high-bandwidth stuff (also not good for
business if people can't see Tiger), or you need to do some sort of
shaping to not piss of anyone too much while keeping expenses in line.

Good luck! (Now throw in "net neutrality" and see where we are heading.)
-- 
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman at es.net			Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4  EADA 927D EBB3 987B 3751
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 224 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20080617/399273bc/attachment-0001.sig>