[AusNOG] DDoS Attacks - Painful and Persistent.

[Roland Dobbins]

On Aug 10, 2009, at 1:37 PM, Roland Dobbins wrote:

> This is a good reason to ensure one has good visibility into traffic
> into/out of the IDC, as well as cross-bound traffic within the IDC -
> catching compromised hosts early-on can help in limiting the impact of
> a compromise.

Also, I find it interesting that you're seeing purported 8KB packet- 
sizes - where are these large packets ingressing your network  
(traceback is a great benefit of NDE)?  Is it possible that some of  
this traffic is originating within your IDC?

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

         Unfortunately, inefficiency scales really well.

		   -- Kevin Lawton