[nsp-sec] DDOS against www.de-cix.net

[Scott A. McIntyre]

On Jan 27, 2010, at 11:15 , Wolfgang Tremmel wrote:

> ----------- nsp-security Confidential --------
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello,
> 
> we are now being attacked since Friday. First a TCP-Syn attack which we
> could mitigate by using an external proxy, now a HTTP-Get attack against
> www.de-cix.net (currently 212.224.123.98)
> 

There is definitely a lot of spoofing taking place here - we are seeing a lot of SYN-ACK packets, as well as ICMP - no actual sign of sources though.

Just so you know!

Scott A. McIntyre
XS4ALL Internet B.V. / KPN Telecom / etc