DDoS attacks...?
Matthew Sullivan
matthew at sorbs.net
Wed Nov 17 05:00:31 UTC 2004
As a followup for those interested:
Matthew Sullivan wrote:
> Can people make a quick check the for DDoS attacks on 209.220.100.158
> in the last 12 hours (to 00:00 17th Nov 2004 GMT+0) - I am trying to
> get the exact time it appeared to occur, however I suspect it was in
> the time period of 13:00-14:00 16th Nov 2004 GMT+0 which coincided
> with the SORBS primary network dropping out of the global routing
> table (I don't have a clue as to why that happened either - it's being
> investigated). (I have a suspicion that there was no DDoS attack and
> as the IP hosts NS1.SORBS.NET I'm guessing that when the primary NS
> for SORBS.NET dropped of the face of the earth the resulting increase
> in traffic came as a bit of a shock for the network admin/owner).
Turns out the 'DDoS' was in actual fact not a deliberate DDoS and was
indeed excessive DNS queries all going to the same host due to problems
with a global routing table update/corruption last night (localtime).
Regards,
Mat
More information about the NANOG
mailing list