<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US">Absolutely… that’s why I said it could have been a TCP low level none flood style attack, which again would be very hard to prove other
than looking at packets per second instead of total throughput.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US">Kindest Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Verdana",sans-serif;color:black">James Braunegg<br>
</span></b><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">P:</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black"> 1300 769 972 |
<b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616<o:p></o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">E:</span></b><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="mailto:james.braunegg@micron21.com"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">james.braunegg@micron21.com</span></a></span><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">
| <b>ABN:</b> 12 109 977 666 <br>
<b>W:</b> <a href="http://www.micron21.com/ddos-protection"><span style="color:black">www.micron21.com/ddos-protection</span></a>
<b>T:</b> @micron21<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">Follow us on
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="http://www.twitter.com/micron21"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">Twitter</span></a></span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">
</span><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">for important service and system updates.<br>
<br>
</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black"><img border="0" width="250" height="39" id="Picture_x0020_1" src="cid:image001.jpg@01D1F2F1.5B4C1D10" alt="M21.jpg"></span><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black"><br>
</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:black">This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not
use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Scott Howard [mailto:scott@doc.net.au]
<br>
<b>Sent:</b> Wednesday, 10 August 2016 10:22 AM<br>
<b>To:</b> James Braunegg <james.braunegg@micron21.com><br>
<b>Cc:</b> andy@coastalaudio.com.au; Nathan Brookfield <Nathan.Brookfield@simtronic.com.au>; James Hodgkinson <yaleman@ricetek.net>; Tim Raphael <raphael.timothy@gmail.com>; ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] census issues tonight<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">On Tue, Aug 9, 2016 at 5:03 PM, James Braunegg <<a href="mailto:james.braunegg@micron21.com" target="_blank">james.braunegg@micron21.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">If you look on public peering exchanges around the world for an abnormal increase of traffic during last
night, you don’t see any such increase, nor any evidence.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">I.e. When CloudFlare reported a large 300gbit+ scale NTP reflection attack back in 2014 peering’s graphs
around the world showed a spike in traffic.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You are presuming a network-based DDoS. Application-level (D)DoS's are often much simpler to do, and will not result in a visible increase in traffic.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> Scott<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>