uunet

Mon Jan 20 06:00:03 UTC 2003

Last week we experienced a significant (for us anyway) DDOS against one
of our customers and UUNET was one of the quickest to respond. No, we
are not a UUNET customer but Chris (with UUNET) responded very quickly
(within 30min I believe) to a post we made to a mail list and began
blackholing traffic in UUNET's network. BTW, this was at about 10:30pm
on a Monday night his time.

WorldCom/UUNET is an easy company to beat on (and probably deserves it
some of the time) but the UUNET security team is, in my opinion, top
notch. They have been very willing to share information and techniques
and been very willing to help others implement DDOS/DOS tracking.

I'm not disputing the fact that you probably had a bad experience
getting through to the right person. It sounds like the UUNET NOC (like
many NOCs) was not terribly helpful. Other forms of communication like
NANOG and nsp-sec are often times better forms of communication when it
comes to DOS/DDOS attacks and other security issues. Hopefully that will
change over time.

Regards,
Chad

-----------------------------------
Chad Skidmore
One Eighty Networks
http://www.go180.net
509-688-8180 

-----Original Message-----
From: Scott Granados [mailto:scott at wworks.net] 
Posted At: Sunday, January 19, 2003 2:27 PM
Posted To: NANOG
Conversation: uunet
Subject: Re: uunet

Its just unfortunate that some companies not mentioning names feel this
is good practice.  Others don't feel this way which is a good thing.
Just a note, uunet wouldn't take my call when a ddos attach originated
on their network either.  Same response with the exception of "Well we
don't have security persons available after hours so write us an e-mail
and you may get
a response within 48 hours".   Which to me sounded just plain wrong
because
I've seen threds onhere to the contrary.

----- Original Message -----
From: "blitz" <blitz at macronet.net>
To: "Scott Granados" <scott at wworks.net>
Cc: <nanog at merit.edu>
Sent: Sunday, January 19, 2003 1:24 AM
Subject: Re: uunet

> I'll copy this email, and keep it for reference when someone asks 
> about buying service from UUnet...thanks...
>
> At 17:17 1/18/03 -0800, you wrote:
>
> >What's interesting is that I just tried to call the noc and was told 
> >"We have to have you e-mail the group"
> >
> >my response, I can't I have no route working to uunet
> >
> >"Well you have to"
> >
> >my response, ok I'll use someone elses mail box where do I mail?
> >
> >"We can't tell you your not a customer"
> >
> >My response its a routing issue do you have somewhere I can e-mail 
> >you.
> >
> >"Your not my customer I really don't care"  *click*
> >
> >Nice. professional too.
> >
> >Anyone have a number to the noc that someone with clue might answer?
> >
> >----- Original Message -----
> >From: "David Diaz" <techlist at smoton.net>
> >To: "Scott Granados" <scott at wworks.net>; <nanog at merit.edu>
> >Sent: Saturday, January 18, 2003 4:35 PM
> >Subject: Re: uunet
> >
> >
> > > Im not seeing anything coming from qwest.
> > >
> > >
> > >
> > > At 16:55 -0800 1/18/03, Scott Granados wrote:
> > > >Is something up on uunet tonight?
> > > >
> > > >It looks to me that dns is broken forward and reverse but more 
> > > >likely
it
> > > >looks like a bad bogan fiilter popped up suddenly.  I have issue 
> > > >as
soon
> >as
> > > >I leave mfn's network and hit uunet.
> > >
> > > --
> > >
> > > David Diaz
> > > dave at smoton.net [Email]
> > > pagedave at smoton.net [Pager]
> > > www.smoton.net [Peering Site under development]
> > > Smotons (Smart Photons) trump dumb photons
> > >
> > >
> > >
>
>