relays.osirusoft.com
Michael K. Smith
mksmith at noanet.net
Wed Aug 27 00:36:45 UTC 2003
On 8/26/03 4:45 PM, "Matthew Sullivan" <matthew at sorbs.net> wrote:
>
> George William Herbert wrote:
>
>> Yes, this is due to a massive DDOS. At least three
>> of the spamfilter BLs have been so attacked this week.
>>
>> Some of the networks represented here have not been
>> as timely about helping the BL providers with the
>> DDOSes as they could be. Please keep in mind that
>> without dynamic BLs anti-spam folks will fall back
>> to sending out static block maps, which getting your
>> IP space out of will be difficult if not impossible.
>>
>> IT IS VERY MUCH IN NETWORK OPERATORS
>> BEST INTEREST THAT THIS NOT HAPPEN.
>>
>> Please take what measures are necessary to help
>> ensure that your customers are not intentionally
>> or neglegently DDOSing the BLs.
>>
>>
> Well said George,
>
> I have been one of the recepients of the DDoS attacks. If people see
> non DNS UDP traffic or non Type 3 ICMP traffic aimed at 203.15.51.32/27
> it is likely DDoS traffic. Currently I still have at least one IP in
> that range Null Routed by upstreams.
>
> SORBS may have to implement a subscription model soon to fund more hosts
> around the world if the DDoS's continue, I am desperately trying to
> avoid it, should it become nessessary it will be for the +50k
> queries/day users out there. The point is SORBS is funded soley by
> myself and through hosting dontations - I have 5 public secondaries
> donated currently, and I cannot afford, personally, any DDoS proofing
> other than that I have now. I know of at least 3 other DNSbls that are
> experiencing DDoS issues, and one DNSbl operator that is scared stiff of
> DDoS.
>
> Yours
>
> Mat
>
> Note: If anyone wants to talk about SORBS, public secondaries,
> donations, policy etc... this is not the forum, please contact me off list.
>
>
>
>
Hello:
If you and others are experiencing DDOS attacks it would be a good idea to
get the affected IP's on to the various lists associated with the tracking
of such events. If you would like me to post them, I would be happy to do
so. Please let me know the IP blocks, other than the one mentioned above,
and I will post them to the lists.
Thanks,
Mike
--
Michael K. Smith NoaNet
206.219.7116 (work) 206.579.8360 (cell)
mksmith at noanet.net http://www.noanet.net
More information about the NANOG
mailing list