[nsp-sec] 12-15 Gbps DNS Amplification attack against 31.222.133.87/32

[Mike Tancsa]

On 4/29/2013 2:42 PM, Tom Sands wrote:
> ----------- nsp-security Confidential --------
> We've had this attack ongoing for about 5 days now and looking for some
> assistance.


Yikes, I noticed that this AM in AS11647 :( All the spoofed addresses
are coming in via AS174 at my exchange with them in Toronto, Canada.

More than half the packets are destined to customers who have cleaned up
their open resolvers.  However, there were a few who still have not done
so, and we are taking further steps to get them to clean up their boxes.

	---Mike
-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/