Last week we experienced a significant (for us anyway) DDOS against one of our customers and UUNET was one of the quickest to respond. No, we are not a UUNET customer but Chris (with UUNET) responded very quickly (within 30min I believe) to a post we made to a mail list and began blackholing traffic in UUNET's network. BTW, this was at about 10:30pm on a Monday night his time. WorldCom/UUNET is an easy company to beat on (and probably deserves it some of the time) but the UUNET security team is, in my opinion, top notch. They have been very willing to share information and techniques and been very willing to help others implement DDOS/DOS tracking. I'm not disputing the fact that you probably had a bad experience getting through to the right person. It sounds like the UUNET NOC (like many NOCs) was not terribly helpful. Other forms of communication like NANOG and nsp-sec are often times better forms of communication when it comes to DOS/DDOS attacks and other security issues. Hopefully that will change over time. Regards, Chad ----------------------------------- Chad Skidmore One Eighty Networks http://www.go180.net 509-688-8180 -----Original Message----- From: Scott Granados [mailto:scott@wworks.net] Posted At: Sunday, January 19, 2003 2:27 PM Posted To: NANOG Conversation: uunet Subject: Re: uunet Its just unfortunate that some companies not mentioning names feel this is good practice. Others don't feel this way which is a good thing. Just a note, uunet wouldn't take my call when a ddos attach originated on their network either. Same response with the exception of "Well we don't have security persons available after hours so write us an e-mail and you may get a response within 48 hours". Which to me sounded just plain wrong because I've seen threds onhere to the contrary. ----- Original Message ----- From: "blitz" <blitz@macronet.net> To: "Scott Granados" <scott@wworks.net> Cc: <nanog@merit.edu> Sent: Sunday, January 19, 2003 1:24 AM Subject: Re: uunet

I'll copy this email, and keep it for reference when someone asks about buying service from UUnet...thanks...

At 17:17 1/18/03 -0800, you wrote:

...

What's interesting is that I just tried to call the noc and was told "We have to have you e-mail the group"

my response, I can't I have no route working to uunet

"Well you have to"

my response, ok I'll use someone elses mail box where do I mail?

"We can't tell you your not a customer"

My response its a routing issue do you have somewhere I can e-mail you.

"Your not my customer I really don't care" *click*

Nice. professional too.

Anyone have a number to the noc that someone with clue might answer?

----- Original Message ----- From: "David Diaz" <techlist@smoton.net> To: "Scott Granados" <scott@wworks.net>; <nanog@merit.edu> Sent: Saturday, January 18, 2003 4:35 PM Subject: Re: uunet

...

Im not seeing anything coming from qwest.

At 16:55 -0800 1/18/03, Scott Granados wrote:

...

Is something up on uunet tonight?

It looks to me that dns is broken forward and reverse but more likely it looks like a bad bogan fiilter popped up suddenly. I have issue as soon as I leave mfn's network and hit uunet.

--

David Diaz dave@smoton.net [Email] pagedave@smoton.net [Pager] www.smoton.net [Peering Site under development] Smotons (Smart Photons) trump dumb photons