It's ironic how these events make their way into the media but no one in the media seems inquisitive enough to truly follow up on an event. Was the attack widely distributed or were the streams large enough to traceback with netflow, etc? Was there any success in identifying compromised machines? Any forensic clues found? -----Original Message----- From: dies [mailto:dies@pulltheplug.com] Sent: Wednesday, October 23, 2002 1:06 AM To: Richard A Steenbergen Cc: Sean Donelan; nanog@merit.edu Subject: Re: WP: Attack On Internet Called Largest Ever Agreed...I worked these attacks on UUNET's backbone and quite honestly none of them was over 100mbit worth of traffic. We see this everyday, this was nothing out of the ordinary except the destination... Shrug...fear is an easy weapon to wield, eh? On Tue, 22 Oct 2002, Richard A Steenbergen wrote:

On Tue, Oct 22, 2002 at 05:15:21PM -0400, Sean Donelan wrote:

...

http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html

The heart of the Internet sustained its largest and most sophisticated attack ever, starting late Monday, according to officials at key online backbone organizations.

Looked like a pretty piddly and unintelligent smurf/ping flood combo to me. The state of the so-called "experts" saddens me more with each passing day.

-- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)