[nsp-sec] ACK 2116/3307 Re: heavy udp fragments attack

[sthaug at nethelp.no]

> we are currently (actually since monday) under heavy attack with udp  
> fragments on port 53 against all our nameserver, mailservers, some  
> peering interfaces and some customers. The attacks are mostly  
> mitigated but every few hours new targets pop up.
> 
> We would appreciate if you could check if you have flows with udp/53  
> fragments towards 164.128.0.0/16 and block them if possible.

ACK 2116 + 3307, verified with netflow & list of sources sent to abuse.
Starting on mitigation.

Steinar Haug, AS 2116 + 3307