We have been the target of some of the largest NTP reflection attacks ever seen, and all I can really stress is build great relationships with your upstreams -<span></span> they'll more than likely respond quicker and give you the results you want.<div>
<br></div><div>In Australia, Vocus and Telstra definitely stepped up and were very helpful.</div><div><br></div><div>As Skeeve mentioned below, NTP is just the current FoTM, there's still plenty of vectors available like SNMPv2, SSDP etc.<br>
<div><br>On Wednesday, April 16, 2014, Andrew Tschudi <<a href="mailto:andrewtschudi@gmail.com">andrewtschudi@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Thanks Lindsay we only have one fiber provider in our building, with no other options.<div><br></div><div>I am considering IP transit from another provider and using our fiber provider as back haul but we are still in contract and not sure if i can change this.</div>
<div><br></div><div>Andrew</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Apr 16, 2014 at 10:32 AM, Lindsay Hill <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','lindsay.k.hill@gmail.com');" target="_blank">lindsay.k.hill@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">You probably need to think about changing your upstream provider, if they can't help deal with this - either by them mitigating traffic, or by giving your RTBH capabilities.</div>
<div class="gmail_extra">
<br><br><div class="gmail_quote">On Wed, Apr 16, 2014 at 12:24 PM, Andrew Tschudi <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','andrewtschudi@gmail.com');" target="_blank">andrewtschudi@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">The problem is our upstream provider could not help us stop the traffic and we ran out of network capacity. Engineering said they can look at blocking the traffic as part of a special project which might take 6 weeks.<span><font color="#888888"><div>
<br></div><div>Andrew</div><div> </div></font></span></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Apr 16, 2014 at 10:15 AM, Dobbins, Roland <span dir="ltr"><<a href="javascript:_e(%7B%7D,'cvml','rdobbins@arbor.net');" target="_blank">rdobbins@arbor.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
On Apr 16, 2014, at 7:13 AM, Andrew Tschudi <<a href="javascript:_e(%7B%7D,'cvml','andrewtschudi@gmail.com');" target="_blank">andrewtschudi@gmail.com</a>> wrote:<br>
<br>
> We were the target of the attacks and have no open NTP servers on our network.<br>
<br>
Gotcha.<br>
<br>
In that case, you can use QoS to police down non-76-byte UDP/123 traffic to 1mb/sec in aggregate or thereabouts, and ask your upstream transit(s) to do the same on their side of the link(s).<br>
<br>
-----------------------------------------------------------------------<br>
Roland Dobbins <<a href="javascript:_e(%7B%7D,'cvml','rdobbins@arbor.net');" target="_blank">rdobbins@arbor.net</a>> // <<a href="http://www.arbornetworks.com" target="_blank">http://www.arbornetworks.com</a>><br>
<br>
Luck is the residue of opportunity and design.<br>
<br>
-- John Milton<br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="javascript:_e(%7B%7D,'cvml','AusNOG@lists.ausnog.net');" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="javascript:_e(%7B%7D,'cvml','AusNOG@lists.ausnog.net');" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>
</blockquote></div></div><br><br>-- <br><div dir="ltr">
<p><b>Trent Farrell</b></p><p><b>Riot Games</b></p>
<p><b>IP Network Engineer</b></p>
<p>E: <a href="mailto:tfarrell@riotgames.com" target="_blank"><span>tfarrell@riotgames.com</span></a> | IE: +353 83 446 6809 | US: +1 424 285 9825 </p>
<p>Summoner name: Foro</p></div><br>