Hello, On Wed, 26 Nov 2008 05:37:59 -0500 Pete Templin <petelists@templin.org> wrote:
One of my customers, a host at 64.8.105.15, is feeling a "bonus" ~130kpps from 88.191.63.28. I've null-routed the source, though our Engine2 GE cards don't seem to be doing a proper job of that, unfortunately. The attack is a solid 300% more pps than our aggregate traffic levels.
It's coming in via 6461, but they don't appear to have any ability to backtrack it. Their only offer is to blackhole the destination until the attack subsides. BGP tells me the source is in AS 12322, a RIPE AS that has little if any information publicly visible.
12322 is Free, a DSL (and now FTTH) provider in France. They also have a dedicated server hosting service. 88.191.63.28 is one of these dedicated server that is hosted in one of their DC : traceroute to 88.191.63.28 (88.191.63.28), 30 hops max, 60 byte packets ... 7 10ge-1-50.bzn-swr5.dedibox.fr (88.191.2.37) 353.946 ms 334.180 ms 336.400 ms 8 sd-11899.dedibox.fr (88.191.63.28) 338.403 ms 374.956 ms 376.837 ms I thought these were supposed to be connected at 100MBps, but if you see more than that, then it is possible that they are now connected thru a GBps port. You can try to contact the dedibox NOC, and Free : noc@free.fr can be a nice place to start... Paul
Any pointers on what to do next?
Thanks,
Pete
-- Paul Rolland E-Mail : rol(at)witbe.net CTO - Witbe.net SA Tel. +33 (0)1 47 67 77 77 Les Collines de l'Arche Fax. +33 (0)1 47 67 77 99 F-92057 Paris La Defense RIPE : PR12-RIPE Please no HTML, I'm not a browser - Pas d'HTML, je ne suis pas un navigateur "Some people dream of success... while others wake up and work hard at it" All I need to have a good time, Is a reefer, a woman and a bottle of wine. With those three things I don't need no sunshine, A reefer, a woman and a bottle of wine. All I want is to never grow old, I want to wash in a bathtub of gold. I want 97 kilos already rolled, I want to wash in a bathtub of gold. I want to light my cigars with 10 dollar bills, I like to have a cattle ranch in Beverly Hills. I want a bottle of Red Eye that's always filled, I like to have a cattle ranch in Beverly Hills. -- Country Joe and the Fish, "Zachariah"