nanog mailing list archives
RE: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours
From: "Justin M. Streiner" <streiner () cluebyfour org>
Date: Thu, 23 Jul 2015 09:25:33 -0400 (EDT)
On Thu, 23 Jul 2015, Nicholas Warren wrote:
How will the customer know the ISP is blocking the traffic? Does the FCC make ISPs disclose this information?
If a customer is legitimately trying to reach someone in one of the affected IP ranges and failing, at some point, they will either a) give up and try later, or b) contact their provider to try to find out what's going on.
If it's something widespread enough that the ISP's support line is blowing up with calls, I'd hope they would either put some sort of announcement on their website/support site/support line.
As with anything else in the ISP world, it's about striking an appropriate balance. If ISP X is getting hit with DDoS traffic hard enough to severely impact their business, that can warrant an emergency response, albeit likely a short-term/tactical response. If not, perhaps a more limited response is better. Again, each provider is free to run their network as they see fit.
The balance point can also change if downstream ISPs are involved, since ISP X might be making the decision to block or not block traffic for the downstreams, with or without their consent.
jms
On 07/22/2015 09:01 PM, Justin M. Streiner wrote:You're certainly free to block whatever traffic you wish, but your customers might not appreciate a heavy-handed approach to stopping bad traffic at the gates.
Current thread:
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours, (continued)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Colin Johnston (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Colin Johnston (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours mikea (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Jared Mauch (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Pavel Odintsov (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Justin M. Streiner (Jul 22)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Stephen Satchell (Jul 23)
- RE: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Nicholas Warren (Jul 23)
- RE: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Justin M. Streiner (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Ca By (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 23)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Mike Hammett (Jul 21)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Christopher Morrow (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours ML (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Colin Johnston (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours Valdis . Kletnieks (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours James Milko (Jul 20)
- Re: 20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours John Weekes (Jul 20)