[nsp-sec] 50Gbps NTP Attack, 23377 Source IP addresses

[Andrew W Elble]

Phil Rosenthal <pr at isprime.com> writes:

> ----------- nsp-security Confidential --------
>
> Hello all,
>
> We have had a reoccuring NTP Reflected DDoS attack against one of our
> customers, and would love it if we could get some of these open NTP
> servers could be closed up.
>
> The full list is attached as a text file due to it’s size.
>
> By traffic, the top ASN’s are 4713, 701, 3462, 7922, 9737, 4134, 6830,
> 12741, 1659, 43700, 174, 9808, 3269, 45899, 2907, 7018, 3356, 9498,
> 6128, 36531, 13999, 209, 14, 3215, 8732, 47764, 3549, 25019, 3320,
> 13768.

ACK AS4385

-- 
Andrew W. Elble
aweits at discipline.rit.edu
Infrastructure Engineer, Communications Technical Lead
Rochester Institute of Technology
PGP: BFAD 8461 4CCF DC95 DA2C B0EB 965B 082E 863E C912