<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<snarky remark> BCP38 <more snarky remarks><br>
<br>
After all this time and knowledge why people still think
<source ip> are legit evidence in DDoS instances...<br>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 2019-12-09 15:15, Tim Požár wrote:<br>
</div>
<blockquote type="cite"
cite="mid:88e017eb-8f92-ba34-0ca0-438a00804e62@lns.com">
<pre class="moz-quote-pre" wrap="">This is lame. They should be able to view NAT translation tables or
better yet have some method of watching flows.
Tim
On 12/9/19 12:11 PM, Christopher Morrow wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I'd note that: "what prefixes?" isn't answered here... like: "what is
the thing on your network which is being attacked?"
On Mon, Dec 9, 2019 at 3:08 PM <a class="moz-txt-link-abbreviated" href="mailto:ahmed.dalaali@hrins.net">ahmed.dalaali@hrins.net</a>
<a class="moz-txt-link-rfc2396E" href="mailto:ahmed.dalaali@hrins.net"><ahmed.dalaali@hrins.net></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
Dear All,
My network is being flooded with UDP packets, Denial of Service attack, soucing from Cloud flare and Google IP Addresses, with 200-300 mbps minimum traffic, the destination in my network are IP prefixes that is currnetly not used but still getting traffic with high volume.
The traffic is being generated with high intervals between 10-30 Minutes for each time, maxing to 800 mbps
When reached out cloudflare support, they mentioned that there services are running on Nat so they can’t pin out which server is attacking based on ip address alone, as a single IP has more than 5000 server behind it, providing 1 source IP and UDP source port, didn’t help either
Any suggestions?
Regards,
Ahmed Dala Ali
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
<br>
</body>
</html>