<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi Barry - thanks for the response - this wasn't the case.</div><div><br></div><div>We were on the phone for quite a while with BL, the issue turned out to be at a higher OSI layer with some mitigation strategies BL were using. We're running again now via BL. Happy to discuss further via direct email.</div><div><br></div><div>Mad props to those who responded off list, and the guys at Black Lotus who, in hindsight, looked after us very well (The attack was a little..."dynamic").</div><div><br></div><div id="7fa6408f-d5ce-4c76-abfb-25dd2eaabdfa"><span></span><div>Cheers,<br></div><div><br></div><div>Shannon</div><div><span style="font-family: arial, helvetica, sans-serif; font-size: x-small; color: rgb(0, 51, 102);" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: x-small; color: #003366;"><a href="https://www.linkedin.com/in/shannongernyi" target="_blank" data-mce-href="https://www.linkedin.com/in/shannongernyi"><span style="color: rgb(0, 51, 102);" data-mce-style="color: #003366;">https://www.linkedin.com/in/shannongernyi</span></a></span></div><span></span><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Barry Murphy" <barry@vibecommunications.co.nz><br><b>To: </b>"Shannon Gernyi" <shannon.gernyi@xsv.com.au>, ausnog@lists.ausnog.net<br><b>Sent: </b>Thursday, 18 December, 2014 3:20:24 PM<br><b>Subject: </b>Re: [AusNOG] DDoS impacting some Oz providers into Black Lotus LA?<br><div><br></div><div><div><div><span style="font-family: Calibri, sans-serif;" data-mce-style="font-family: Calibri, sans-serif;">Is it possible that the user is multi-homed, and their other upstream is having them null routed to some upstreams? I’ve seen this happen before in this kind of scenario.</span></div><div><span style="font-family: Calibri, sans-serif;" data-mce-style="font-family: Calibri, sans-serif;"><br> </span></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;" data-mce-style="color: #000000; font-family: Calibri, sans-serif; font-size: 14px;"><div><br></div><div>-- </div><div><div style="font-family: Calibri; font-size: medium;" data-mce-style="font-family: Calibri; font-size: medium;"><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" data-mce-style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; color: rgb(127, 127, 127);" data-mce-style="font-size: 11pt; color: #7f7f7f;">Kind regards,</span><span style="font-size: 11pt;" data-mce-style="font-size: 11pt;"></span></p><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;" data-mce-style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; line-height: 12pt;"><b><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif;" data-mce-style="font-size: 10.5pt; font-family: Helvetica, sans-serif;">Barry Murphy</span></b><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif;" data-mce-style="font-size: 10.5pt; font-family: Helvetica, sans-serif;"> / </span><b><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif; color: rgb(255, 158, 1);" data-mce-style="font-size: 10.5pt; font-family: Helvetica, sans-serif; color: #ff9e01;">Chief Operating Officer</span></b><span style="font-size: 10.5pt; font-family: Helvetica, sans-serif;" data-mce-style="font-size: 10.5pt; font-family: Helvetica, sans-serif;"><br> </span></p></div><div style="font-family: Calibri; font-size: medium;" data-mce-style="font-family: Calibri; font-size: medium;"><br></div></div></div></div></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;" data-mce-style="color: #000000; font-family: Calibri, sans-serif; font-size: 14px;"><br></div><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt" data-mce-style="font-family: Calibri; font-size: 11pt; text-align: left; color: black; border-bottom: medium none; border-left: medium none; padding-bottom: 0in; padding-left: 0in; padding-right: 0in; border-top: #b5c4df 1pt solid; border-right: medium none; padding-top: 3pt;"><span style="font-weight:bold" data-mce-style="font-weight: bold;">From: </span>Shannon Gernyi <<a href="mailto:shannon.gernyi@xsv.com.au" target="_blank" data-mce-href="mailto:shannon.gernyi@xsv.com.au">shannon.gernyi@xsv.com.au</a>><br> <span style="font-weight:bold" data-mce-style="font-weight: bold;">Date: </span>Thursday, 18 December 2014 4:26 pm<br> <span style="font-weight:bold" data-mce-style="font-weight: bold;">To: </span>"<a href="mailto:ausnog@lists.ausnog.net" target="_blank" data-mce-href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net" target="_blank" data-mce-href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br> <span style="font-weight:bold" data-mce-style="font-weight: bold;">Subject: </span>[AusNOG] DDoS impacting some Oz providers into Black Lotus LA?<br></div><div><br></div><div><div><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000" data-mce-style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000;"><div>Hi Noggers,</div><div><br></div><div>It's a bit of a broad query at this stage, but I wanted to throw the question out there as we're seeing some interesting happenings when offloading traffic via Black lotus (US).</div><div><br></div><div>DDoS appears to get scrubbed, but we're suddenly unable to access the victim's site from certain providers (iiNet, Exetel...), but can get there fine from others (Telstra). I don't have a lot of diagnostic information just yet, just wanted to query if anyone else is seeing similar issues or aware of anything. Trace stops before entering Black lotus from affected ISPs.</div><div><br></div><div>Kind Regards,</div><div><br></div><div>Shannon</div></div></div></div></div><div><br></div></div></body></html>