DDoS Attacks Cause of Game Servers
sh.vahabzadeh at gmail.com
Thu Jan 31 07:53:11 UTC 2013
Those ip addresses I send were only sample, its 5 page :D and not only
And you are looking to target 128.141.X.Y its mine and I change it because
of mailing list, maybe attackers are here.
You must check the sources not destination.
On Thu, Jan 31, 2013 at 11:06 AM, Jeroen Massar <jeroen at massar.ch> wrote:
> On 2013-01-31 08:04 , Shahab Vahabzadeh wrote:
> > Hi everybody,
> > Last two days I was under an interesting attack which comes from multiple
> > sources to three of my ADSL users destination.
> You say that it comes from multiple sources to 3 of your DSL users.
> The below source/dest though shows that the destination is from CERN in
> Switzerland, you know the people who build black holes ;)
> The IP does not ping at the moment, but the whois indicates 'dyn' in the
> netname thus that is not too unsurprising.
> > The attack make router to ran out of CPU and we had to reload it to
> > I ask those three users and they said we are only game players and all of
> > them were kids, I think they told the true, they told we are playing:
> > http://intl.garena.com/
> Looks not like a game, just another messenger / IM client.
> > Attacks takes only 20 or 30 minutes and it happens only 4 times in two
> > I could'nt capture any packet but this is out put of my "show ip
> > accounting" that time:
> You'll be needing a bit more info than that... and 117 packets with a
> total of 5148 bytes is not a lot of traffic to put anything down (unless
> it is a targeted attack)
> You might though contact the CERN NOC, if you really think something is
> funny there. Timestamps might be very useful to provide though,
> especially if the IP is really dynamic.
Shahab Vahabzadeh, Network Engineer and System Administrator
Cell Phone: +1 (415) 871 0742
PGP Key Fingerprint = 8E34 B335 D702 0CA7 5A81 C2EE 76A2 46C2 5367 BF90
More information about the NANOG