<div dir="ltr"><div><div>Hi Joshua,<br><br></div><div>They both look like CPE addresses.<br></div><div><br></div>I think the first step would be to take traffic captures to confirm what kind of attack it is (ntp/snmp/dns/chargen) and then implement protections on your border to stop it impacting your customers/s.<br>
</div>If you can't implement protections, then at least with the packet captures can you approach the providers to maybe contact the customers to fix their problems, but this opens another can-o-worms.<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Mar 4, 2014 at 3:12 PM, Joshua Riesenweber <span dir="ltr"><<a href="mailto:joshua.riesenweber@outlook.com" target="_blank">joshua.riesenweber@outlook.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr"><div><div dir="ltr">G'day 'noggers,<div><br></div><div><br></div><div>I had a customer hit with what looks like a DoS attack from (mainly) a couple of addresses address last night: </div><div>
<span style="font-size:12pt"><b>220.239.56.245</b> [</span><span style="font-size:12pt"><a href="http://c220-239-56-245.eburwd6.vic.optusnet.com.au" target="_blank">c220-239-56-245.eburwd6.vic.optusnet.com.au</a>]</span></div>
<div><span style="font-size:12pt"><b>121.214.8.170</b> [</span><span style="font-size:12pt"><a href="http://cpe-121-214-8-170.lnse3.win.bigpond.net.au" target="_blank">cpe-121-214-8-170.lnse3.win.bigpond.net.au</a>]</span></div>
<div><br></div><div>Any tips on tracking this kind of thing down/getting more information? (mainly for reporting) </div><div>I'm guessing by the PTR that second address is a customer endpoint, not Telstra equipment.</div>
<div><br></div><div><br></div><div><br></div><div><br></div><div>Cheers,</div><div>Josh </div> </div></div> </div></div>
<br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>