[nsp-sec] Recent 20 Gbps microburst DoS attack

[Dobbins, Roland]

> On Dec 23, 2017, at 01:38, J. Chambers <jchambers at ucla.edu> wrote:
> 
> If I understand that correctly that means 32 = CS2 (Immediate) and 4 =
> CS5 (Critical).

Right - you should never see that traffic from outside your network. It's purposely designed to disrupt your routing by filling up your high-priority queues.

So, as Nick & Barry have pointed out, re-coloring at the edge is important.  Enforcing situationally-appropriate network access policies is key, as well.

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>