Re: DOS attack assistance?

[Paul Rolland (ポール・ロラン) <rol () witbe net>]

Hello,

On Wed, 26 Nov 2008 05:37:59 -0500
Pete Templin <petelists () templin org> wrote:

> One of my customers, a host at 64.8.105.15, is feeling a "bonus" 
> ~130kpps from 88.191.63.28.  I've null-routed the source, though our 
> Engine2 GE cards don't seem to be doing a proper job of that, 
> unfortunately.  The attack is a solid 300% more pps than our aggregate 
> traffic levels.
>
> It's coming in via 6461, but they don't appear to have any ability to 
> backtrack it.  Their only offer is to blackhole the destination until 
> the attack subsides.  BGP tells me the source is in AS 12322, a RIPE AS 
> that has little if any information publicly visible.

12322 is Free, a DSL (and now FTTH) provider in France. They also have
a dedicated server hosting service.

88.191.63.28 is one of these dedicated server that is hosted in one of their 
DC :
traceroute to 88.191.63.28 (88.191.63.28), 30 hops max, 60 byte packets
...
 7  10ge-1-50.bzn-swr5.dedibox.fr (88.191.2.37)  353.946 ms  334.180 ms  336.400 ms
 8  sd-11899.dedibox.fr (88.191.63.28)  338.403 ms  374.956 ms  376.837 ms

I thought these were supposed to be connected at 100MBps, but if you see
more than that, then it is possible that they are now connected thru a GBps
port.

You can try to contact the dedibox NOC, and Free :
noc () free fr
can be a nice place to start...

Paul

> Any pointers on what to do next?
>
> Thanks,
>
> Pete


-- 
Paul Rolland                                E-Mail : rol(at)witbe.net
CTO - Witbe.net SA                          Tel. +33 (0)1 47 67 77 77
Les Collines de l'Arche                     Fax. +33 (0)1 47 67 77 99
F-92057 Paris La Defense                    RIPE : PR12-RIPE

Please no HTML, I'm not a browser - Pas d'HTML, je ne suis pas un
navigateur "Some people dream of success... while others wake up and work
hard at it" 

All I need to have a good time,
Is a reefer, a woman and a bottle of wine.
With those three things I don't need no sunshine,
A reefer, a woman and a bottle of wine.

All I want is to never grow old,
I want to wash in a bathtub of gold.
I want 97 kilos already rolled,
I want to wash in a bathtub of gold.

I want to light my cigars with 10 dollar bills,
I like to have a cattle ranch in Beverly Hills.
I want a bottle of Red Eye that's always filled,
I like to have a cattle ranch in Beverly Hills.
                -- Country Joe and the Fish, "Zachariah"