DDoS attacks...?

Matthew Sullivan matthew at sorbs.net
Wed Nov 17 05:00:31 UTC 2004


As a followup for those interested:

Matthew Sullivan wrote:

> Can people make a quick check the for DDoS attacks on 209.220.100.158 
> in the last 12 hours (to 00:00 17th Nov 2004 GMT+0) - I am trying to 
> get the exact time it appeared to occur, however I suspect it was in 
> the time period of 13:00-14:00 16th Nov 2004 GMT+0 which coincided 
> with the SORBS primary network dropping out of the global routing 
> table (I don't have a clue as to why that happened either - it's being 
> investigated).  (I have a suspicion that there was no DDoS attack and 
> as the IP hosts NS1.SORBS.NET I'm guessing that when the primary NS 
> for SORBS.NET dropped of the face of the earth the resulting increase 
> in traffic came as a bit of a shock for the network admin/owner).

Turns out the 'DDoS' was in actual fact not a deliberate DDoS and was 
indeed excessive DNS queries all going to the same host due to problems 
with a global routing table update/corruption last night (localtime).

Regards,

Mat




More information about the NANOG mailing list