<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
In reviewing packet captures I now see that these same source addresses were attempting to connect on TCP 80 and 443 (which are closed on our firewalls). The only way I would normally see this “IBR” is via packet capture, and the IPsec connection attempts triggered
a packet capture as part of our diagnostics. They were arriving at a rate of several per second, so likely a SYN-flood rather than bandwidth attack. I’ve reported the source IPs, which were throughout the <span style="font-family: UICTFontTextStyleBody; font-size: 17.17px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); -webkit-text-size-adjust: auto;">142.250.0./16, </span><span style="font-family: UICTFontTextStyleBody; font-size: 17.17px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); -webkit-text-size-adjust: auto;">17.0.0.0/8,
and </span><span style="font-family: UICTFontTextStyleBody; font-size: 17.17px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); -webkit-text-size-adjust: auto;">34.00.0/8 prefixes, to their respective owners. But I suspect the source addresses are spoofed. </span>
<p class="p2" style="margin: 0px; font-stretch: normal; font-size: 17.2px; line-height: normal; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal; min-height: 22.2px; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); -webkit-text-size-adjust: auto;">
<span class="s1" style="font-family: UICTFontTextStyleBody; font-size: 17.17px;"><br>
</span></p>
<div dir="ltr"> -mel</div>
<div dir="ltr"><br>
<blockquote type="cite">On Sep 13, 2023, at 8:05 AM, Mel Beckman <mel@beckman.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr"> <span style="-webkit-text-size-adjust: auto; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
We are also seeing high Sonicwall IPsec VPN false connection attempts since yesterday afternoon. The attempts are originating from Apple and Google IP space, so we simply blocked those entire /8s for IPsec, as we normally don’t get VPN traffic from those organizations.
This could be a DDoS attack.</span><br style="-webkit-text-size-adjust: auto; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<br style="-webkit-text-size-adjust: auto; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
<div dir="ltr" style="-webkit-text-size-adjust: auto; caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">
-mel</div>
<br>
<div dir="ltr"> -mel beckman</div>
<div dir="ltr"><br>
<blockquote type="cite">On Sep 13, 2023, at 7:34 AM, Keith Stokes via Outages <outages@outages.org> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My Fortinet units are reporting slow response time on and off.<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif;"><br>
</span></div>
<div id="Signature"></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Outages <outages-bounces@outages.org> on behalf of Dovid Bender via Outages <outages@outages.org><br>
<b>Sent:</b> Wednesday, September 13, 2023 9:17 AM<br>
<b>To:</b> Cas de Reuver <cas@reuver.co><br>
<b>Cc:</b> outages@outages.org <outages@outages.org><br>
<b>Subject:</b> Re: [outages] Fortinet DNS outage</font>
<div> </div>
</div>
<div>
<div dir="ltr">Seems to be up now
<div><br>
</div>
<div>dovid@dovid-desktop:~$ dig +trace <a href="http://fortiguard.com">fortiguard.com</a><br>
<br>
; <<>> DiG 9.16.1-Ubuntu <<>> +trace <a href="http://fortiguard.com">fortiguard.com</a><br>
;; global options: +cmd<br>
. 513568 IN NS <a href="http://a.root-servers.net">a.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://b.root-servers.net">b.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://c.root-servers.net">c.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://d.root-servers.net">d.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://e.root-servers.net">e.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://f.root-servers.net">f.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://g.root-servers.net">g.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://h.root-servers.net">h.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://i.root-servers.net">i.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://j.root-servers.net">j.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://k.root-servers.net">k.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://l.root-servers.net">l.root-servers.net</a>.<br>
. 513568 IN NS <a href="http://m.root-servers.net">m.root-servers.net</a>.<br>
;; Received 262 bytes from 127.0.0.53#53(127.0.0.53) in 44 ms<br>
<br>
com. 172800 IN NS <a href="http://j.gtld-servers.net">j.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://h.gtld-servers.net">h.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://c.gtld-servers.net">c.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://l.gtld-servers.net">l.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://b.gtld-servers.net">b.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://e.gtld-servers.net">e.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://k.gtld-servers.net">k.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://f.gtld-servers.net">f.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://d.gtld-servers.net">d.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://i.gtld-servers.net">i.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://g.gtld-servers.net">g.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://a.gtld-servers.net">a.gtld-servers.net</a>.<br>
com. 172800 IN NS <a href="http://m.gtld-servers.net">m.gtld-servers.net</a>.<br>
com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766<br>
com. 86400 IN RRSIG DS 8 1 86400 20230926050000 20230913040000 11019 . scu9Z9t8Z0Fcv+X00R6Fl1S9Oo5Md5PzQ3TRWFNfbm7jCgfzUFwgy/qd VAsuWaOuC1qQEVrqmaxDG0NQ9b6rs/8gsrS4Xcf/irMceRIHkRV2NKUw y4IuveeAT0LBlfV89ORpyjc33mO9BOBYlJrm9wWP+takgkp4tQjD9XwV BjJoOsZIOX18vcVWTKDNu9eTu8SMxN4eLikw6J3kjwJ1h31PQ9T+LsBF
RHGLaz1SxWa9WGnsuiVdupnwkI5J1MZDbCEk2gwkcZeDggFKzal6uZgD 9EO2Is2kT7Dq9ALMa2D7YFlcV+C9YjnDCw3PCX0hKrat2aA/aImUUpUB AAZZQg==<br>
;; Received 1202 bytes from 192.36.148.17#53(<a href="http://i.root-servers.net">i.root-servers.net</a>) in 32 ms<br>
<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 172800 IN NS <a href="http://ns1.fortinet.com">
ns1.fortinet.com</a>.<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 172800 IN NS <a href="http://ns2.fortinet.com">
ns2.fortinet.com</a>.<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 172800 IN NS <a href="http://ns3.fortinet.com">
ns3.fortinet.com</a>.<br>
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q2D6NI4I7EQH8NA30NS61O48UL8G5 NS SOA RRSIG DNSKEY NSEC3PARAM<br>
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20230919042437 20230912031437 4459 com. BhTAKUlNk4eQ9008o8XKhQbVhIbR7qbu1IZVm5kKa5zuVwIdBQJZyUSw 9reTyAShz02qyCgrLK9CZqwCoXo7rMDgiGlSvC/ltG/b6ttExqDu3rza QLotrWv0Lh7OMbsFV8BYwEIJPOrfYMAwhNxxAvQOFRfrnusmHvgiEALQ
qGmAebDL9w7c9e0der8WL96zTkxZbYyUpEu788zw04l1/Q==<br>
GOBGJFQ2D7HRVAGHKH7F0275H2B9N3R9.com. 86400 IN NSEC3 1 1 0 - GOBGTU4O5DC02OIEF22F57IRHP0AGSBV NS DS RRSIG<br>
GOBGJFQ2D7HRVAGHKH7F0275H2B9N3R9.com. 86400 IN RRSIG NSEC3 8 2 86400 20230917060131 20230910045131 4459 com. V1O2GE/Oivo+FQU/qUwQjYHHeAwj2JeFRL3/Rr/qAsLcNgJ5II1bCxaO PFKtW+e4+ty27ZwiB9iQ/Jg8hz2Szf9H1htAgdXE+0HdyCDTot/R0KHn sfeoQsfgUbYfF/2ghlSSJmphHScYA/yKQ41JA8qyKV3KKd14LTJtoKLH
dSODM1Io3y1fupvAleWVaqxwxjdu32o9lDmuBZicVf1xLA==<br>
;; Received 703 bytes from 192.43.172.30#53(<a href="http://i.gtld-servers.net">i.gtld-servers.net</a>) in 60 ms<br>
<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 86400 IN A 208.91.114.109<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 86400 IN NS <a href="http://ns1.fortinet.com">
ns1.fortinet.com</a>.<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 86400 IN NS <a href="http://ns3.fortinet.com">
ns3.fortinet.com</a>.<br>
<a href="http://fortiguard.com">fortiguard.com</a>. 86400 IN NS <a href="http://ns2.fortinet.com">
ns2.fortinet.com</a>.<br>
;; Received 153 bytes from 208.91.113.63#53(<a href="http://ns3.fortinet.com">ns3.fortinet.com</a>) in 92 ms<br>
<br>
dovid@dovid-desktop:~$ <br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Wed, Sep 13, 2023 at 10:10 AM Cas de Reuver via Outages <<a href="mailto:outages@outages.org">outages@outages.org</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">FYI: Fortinet DNS servers are down, <a href="http://fortiguard.com" target="_blank">
fortiguard.com</a> itself is unreachable as well.
<div>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr"><br>
</div>
<div>If you do DNS filtering, it might be a good idea to enable "<span style="color:rgb(79,84,88); font-family:Inter,sans-serif; font-size:14px">Allow DNS requests when a rating error occurs" so outages like these don't affect you.</span></div>
<div dir="ltr"><br>
--<br>
Cas de Reuver<br>
<a href="http://reuver.co" target="_blank">http://reuver.co</a></div>
</div>
</div>
</div>
_______________________________________________<br>
Outages mailing list<br>
<a href="mailto:Outages@outages.org" target="_blank">Outages@outages.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/outages" rel="noreferrer" target="_blank">https://puck.nether.net/mailman/listinfo/outages</a><br>
</blockquote>
</div>
</div>
<span>_______________________________________________</span><br>
<span>Outages mailing list</span><br>
<span>Outages@outages.org</span><br>
<span>https://puck.nether.net/mailman/listinfo/outages</span><br>
</div>
</blockquote>
<span>_______________________________________________</span><br>
<span>Outages mailing list</span><br>
<span>Outages@outages.org</span><br>
<span>https://puck.nether.net/mailman/listinfo/outages</span><br>
</div>
</blockquote>
</body>
</html>