DOS attack assistance?

Pete Templin petelists at
Wed Nov 26 10:37:59 UTC 2008

One of my customers, a host at, is feeling a "bonus" 
~130kpps from  I've null-routed the source, though our 
Engine2 GE cards don't seem to be doing a proper job of that, 
unfortunately.  The attack is a solid 300% more pps than our aggregate 
traffic levels.

It's coming in via 6461, but they don't appear to have any ability to 
backtrack it.  Their only offer is to blackhole the destination until 
the attack subsides.  BGP tells me the source is in AS 12322, a RIPE AS 
that has little if any information publicly visible.

Any pointers on what to do next?



More information about the NANOG mailing list