Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical


  • From: Michael K. Smith
  • Date: Tue Aug 26 20:39:10 2003

On 8/26/03 4:45 PM, "Matthew Sullivan" <> wrote:

> George William Herbert wrote:
>> Yes, this is due to a massive DDOS.  At least three
>> of the spamfilter BLs have been so attacked this week.
>> Some of the networks represented here have not been
>> as timely about helping the BL providers with the
>> DDOSes as they could be.  Please keep in mind that
>> without dynamic BLs anti-spam folks will fall back
>> to sending out static block maps, which getting your
>> IP space out of will be difficult if not impossible.
>> Please take what measures are necessary to help
>> ensure that your customers are not intentionally
>> or neglegently DDOSing the BLs.
> Well said George,
> I have been one of the recepients of the DDoS attacks.  If people see
> non DNS UDP traffic or non Type 3 ICMP traffic aimed at
> it is likely DDoS traffic.  Currently I still have at least one IP in
> that range Null Routed by upstreams.
> SORBS may have to implement a subscription model soon to fund more hosts
> around the world if the DDoS's continue,  I am desperately trying to
> avoid it, should it become nessessary it will be for the +50k
> queries/day users out there.  The point is SORBS is funded soley by
> myself and through hosting dontations - I have 5 public secondaries
> donated currently, and I cannot afford, personally, any DDoS proofing
> other than that I have now.  I know of at least 3 other DNSbls that are
> experiencing DDoS issues, and one DNSbl operator that is scared stiff of
> DDoS.
> Yours
> Mat
> Note: If anyone wants to talk about SORBS, public secondaries,
> donations, policy etc... this is not the forum, please contact me off list.


If you and others are experiencing DDOS attacks it would be a good idea to
get the affected IP's on to the various lists associated with the tracking
of such events.  If you would like me to post them, I would be happy to do
so.  Please let me know the IP blocks, other than the one mentioned above,
and I will post them to the lists.


Michael K. Smith          NoaNet
206.219.7116 (work)       206.579.8360 (cell)

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.