Reporting DDOS reflection attacks

Fri Nov 7 18:56:47 UTC 2014

Like most small providers, we occasionally get hit by DoS attacks. We got hammered by an SSDP
reflection attack (udp port 1900) last week. We took a 27 second log and from there extracted
about 160k unique IPs.

It is really difficult to find abuse emails for 160k IPs.

We know about abuse.net but abuse.net requires hostnames, not IPs for lookups and not all IP
addresses have valid DNS entries.

The only other way we know of to report problems is to grab the abuse email addresses is whois.
However, whois is not structured and is not set up to deal with this number of requests - even
caching whois data based on subnets will result in many thousands of lookups.

Long term it seems like structured data and some kind of authentication would be ideal for reporting
attacks. But right now how should we be doing it?