[Outages-discussion] What Dyn IPs to look for in netflow?

[Outages]

See if this helps,

https://labs.ripe.net/Members/massimo_candela/a-quick-look-at-the-attack-on-dyn

--
regards,
/vrode 

> On Oct 22, 2016, at 6:48 PM, Charles Sprickman <spork at bway.net> wrote:
> 
> I wanted to poke through our netflow data from Friday to see if any customers were involved.  Do we have any idea which Dyn IPs were being hit in the east coast attack?
> 
> I’ve been poking around with sorting by packet count to UDP 53, but I’m not even sure this was an application level or volumetric attack.   Nothing is standing out (yet)…
> 
> Thanks,
> 
> Charles
> -- 
> Charles Sprickman
> NetEng/SysAdmin
> Bway.net - New York's Best Internet www.bway.net
> spork at bway.net - 212.982.9800
> 
> 
> 
> _______________________________________________
> Outages-discussion mailing list
> Outages-discussion at outages.org
> https://puck.nether.net/mailman/listinfo/outages-discussion
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/outages-discussion/attachments/20161024/87a1c245/attachment.html>