Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Info on the DoS attacks.

  • From: Sean Donelan
  • Date: Thu Feb 10 01:26:55 2000

On Wed, 09 February 2000, Joe Shaw wrote:
> I'd be worried if they didn't have theories or know about the known DDoS
> attacks, but not if they didn't have specifics.  Tier1 NSP's seem to be
> very tight lipped about these sorts of things when they are the 
> victim.  I'm sure there are GC employees on this list, but none have come
> forward to give any details.  Could be a gag order, which wouldn't shock
> me at all.  Hopefully we'll know something eventually, but for now we're
> all mushrooms when it comes to official information.

I guess the techies reduced to reading the New York Times for technical

Today's NYT has a description from GlobalCenter's PR person.  The Yahoo
attack was a large number of ICMP EchoReplies(PINGs) coming via GlobalCenter's
50 peering connections (about half of GlobalCenter's total peering connections).
Which may explain the "50" number I've been hearing.  The original ICMP EchoRequests listed Yahoo as the source address and were directed to other
networks which replied to Yahoo.  GlobalCenter installed rate-limits, but
didn't know if they are effective in preventing attacks.

Yahoo's spokesperson confirmed GlobalCenter's account.

(free NYT registration required)

Note: other people have sent me private mail saying it was actually a
different method, but this appears to be the official statement out of
GlobalCenter and Yahoo.

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.