also seeing some udp 6667 irc is usually tcp 6667 so this looks odd. ----- Original Message ----- From: "Todd A. Blank" <todd.blank@ipoutlet.com> To: <scott@wworks.net> Cc: <nanog@merit.edu> Sent: Friday, January 24, 2003 11:10 PM Subject: RE: Level3 routing issues?

It's 1434 and I also see 137 138 551. Big DDOS. It's hitting everything on our network coming from lots of different places...

-----Original Message----- From: Scott Granados [mailto:scott@wworks.net] Sent: Saturday, January 25, 2003 1:41 AM To: Alex Rubenstein Cc: hc; nanog@merit.edu Subject: Re: Level3 routing issues?

We just had a box inside one of my customers networks start sending tons of small packets not sure what kind yet.

On Sat, 25 Jan 2003, Alex Rubenstein wrote:

...

I dunno about that. But, I am seeing, in the last couple hours, all

kinds

...

of new traffic.

like, customers who never get attacked or anything, all of a sudden:

http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.ht ml

...

We are seeing this on ports all across out network -- nearly 1/2 our

ports

...

are in delta alarm right now.

Anyone else?

I will dig more to look at the traffic.

On Sat, 25 Jan 2003, hc wrote:

...

Anyone seeing routing problems with Level3 at this hour? I just witnessed tons of prefixes behind level3's network withdraw. Any information on what is happening (if you know) would be great.

Thanks!

...

-hc

-- Alex Rubenstein, AR97, K2AHR, alex@nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --