[nsp-sec] DoS attack to 164.67.228.152

[JASON CHAMBERS]

Hello all,


Over the weekend we experienced a brief DoS attack to our main site
www.ucla.edu (164.67.228.152).  It lasted a few hours and peaked about 60
Mbps / 150k pps, during which it overflowed the state table in the ASA
fronting that site.  Small event by NSP measurements but maybe of interest
to some.


Rough start/stop times (UTC):

2020-07-26 22:00 to 2020-07-27 01:30


Attack signature:

SYN Flood, 52 byte packets.  ~260k unique Source IPs.


If you turn up anything mildly interesting we'd enjoy hearing about it.


Thanks,

--Jason