We have a DOS attach currently underway via our C&W transit link. This is consuming all bandwidth on the C&W link. This is NOT transiting our other backbone links Source IP's are random Dest IP is 206.29.129.98 which is a Co-Lo server using 206.29.129.96 /27 Certainly would be nice if people would filter on there edges. If anyone can lend help in finding this nice person doing this, there will be a reward at NANOG San Jose! :) Here is a snip from CFLOW mm/dd/yy hh:mm:ss ii oi srcAS src_address mk port next_hop_addr dstAS dst_address mk port pr tos flgs packets bytes -------- -------- -- -- ----- --------------- -- ----- --------------- ----- --------------- -- ----- -- --- ---- ---------- ---------- 01/22/100 23:54:30 2 1 0 168.87.199.44 00 23098 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 195.64.161.18 00 28986 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 159.225.88.89 00 31034 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 51.173.107.119 00 34874 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 72.228.241.56 00 39226 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 114.152.168.77 00 45114 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 6.198.65.52 00 49210 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 218.86.51.65 00 55610 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 148.224.190.10 00 61242 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 38.123.67.54 00 59 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 178.119.185.125 00 1851 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 119.254.14.35 00 8507 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 5.4.243.62 00 14139 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 57.135.125.85 00 16187 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 56.100.199.112 00 20795 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 35.18.98.42 00 27451 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 129.177.110.76 00 30523 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 166.57.114.31 00 33083 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 88.123.137.92 00 37435 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 170.35.224.39 00 43579 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 59.166.68.52 00 48955 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 167.153.104.107 00 53051 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 179.106.107.86 00 55611 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 88.195.189.97 00 59963 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 250.102.51.105 00 64827 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 211.55.122.90 00 4924 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40 01/22/100 23:54:30 2 1 0 149.44.239.105 00 6716 206.29.129.98 0 206.29.129.98 27 23 6 8 00 1 40