[nsp-sec] short ~2 mpps flood towards AS20773

[Felix Schueren]

Dear colleagues,
a short (~30-60seconds) burst of ~2 million pps UDP love towards
92.51.130.129 started at 2009-01-15 22:11:10.100 CET (GMT+01) (and
obliterated the poor VPS :p) - detailed ports & pps attached, AS
overview inline, appears to be unspoofed.

;Src AS | Src IP           | AS Info
1955    | 193.6.5.3        | HBONE-AS HUNGARNET
4837    | 60.31.214.2      | CHINA169-BACKBONE CNCGROUP China169
12322   | 88.191.15.25     | PROXAD AS for Proxad/Free ISP
12322   | 88.191.82.234    | PROXAD AS for Proxad/Free ISP
14037   | 64.18.141.90     | AS-RVB-1 - RackVibe LLC
15003   | 70.32.39.20      | NOBIS-TECH - Nobis Technology Group, LLC
16131   | 84.243.219.114   | GRAFIX-IS GrafiX Internet B.V.
16265   | 94.75.207.12     | LEASEWEB LEASEWEB AS
16276   | 91.121.174.135   | OVH OVH
21409   | 213.246.52.74    | IKOULA IKOULA European Backbone AS
22576   | 64.92.167.58     | LAYER3-ASN - Layered Technologies, Inc.
22576   | 72.36.167.138    | LAYER3-ASN - Layered Technologies, Inc.
25459   | 217.170.13.88    | NEDZONE-AS NedZone Internet BV
25459   | 217.170.14.130   | NEDZONE-AS NedZone Internet BV
25459   | 217.170.14.165   | NEDZONE-AS NedZone Internet BV
25525   | 213.247.51.207   | REASONNET-AS Reasonnet IP Networks B.V.
25761   | 72.20.2.42       | STAMINUS-COMM - Staminus Communications
27645   | 66.79.165.222    | ASN-NA-MSG-01 - Managed Solutions Group
29550   | 92.48.84.215     | EUROCONNEX-AS Blueconnex Networks Ltd
29695   | 84.234.141.2     | LYSE-AS Lyse Tele AS
30058   | 74.63.78.24      | FDCSERVERS - FDCservers.net
30209   | 198.247.173.213  | GSI - GSI Hosting
30496   | 72.9.153.205     | COLO4 - Colo4Dallas LP
32232   | 72.0.111.104     | IGLOBALNETWORKS - iGlobalNetworks.com, Inc.
35366   | 85.31.186.72     | ISPPRO-AS ISPpro Internet KG
36024   | 72.249.185.18    | COLO4-CO - Colo4Dallas LP
36217   | 207.226.88.15    | IPN - IronPath Networks
41828   | 91.185.194.96    | TUSMOBIL TUSMOBIL - core network
42093   | 195.22.100.71    | INTERRACKS-AS InterRacks Network
43560   | 78.41.205.173    | PANTHERIT Panther IT Services

kind regards,

Felix

PS: data from 1/1000 sampling, multiply pkt/pps/byte/bps with 1000

-- 
Felix Schüren
Head of NOC

------------------------------------------------------------------
Host Europe GmbH - http://www.hosteurope.de
Welserstraße 14 - D-51149 Köln - Germany
Telefon: (0800) 4 67 83 87 - Telefax: (01805) 66 32 33
HRB 28495 Amtsgericht Köln - UST ID DE187370678
Geschäftsführer:
Uwe Braun - Alex Collins - Mark Joseph - Patrick Pulvermüller
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: inbound-flood-as20773-2009-01-15.txt
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20090116/a6ded0a2/attachment-0001.txt>