On 25/07/2019 14:37, John Von Essen wrote:

We are experiencing a massive DDoS from three Vodafone /16’s. The DDoS is spread throughout the entire range.

You say *Distributed*, from that I would expect that this traffic is ingressing at multiple locations in your network? I'd be surprised if Vodafone's domestic Italian network would spread traffic to your ASN over multiple paths, and so if it is coming in from multiple ingress points, you're probably looking at spoofed-source traffic. -- Tom