[AusNOG] DDoS impacting some Oz providers into Black Lotus LA?

[Shannon Gernyi]

Hi Barry - thanks for the response - this wasn't the case. 

We were on the phone for quite a while with BL, the issue turned out to be at a higher OSI layer with some mitigation strategies BL were using. We're running again now via BL. Happy to discuss further via direct email. 

Mad props to those who responded off list, and the guys at Black Lotus who, in hindsight, looked after us very well (The attack was a little..."dynamic"). 

Cheers, 

Shannon 
https://www.linkedin.com/in/shannongernyi 

----- Original Message -----

From: "Barry Murphy" <barry at vibecommunications.co.nz> 
To: "Shannon Gernyi" <shannon.gernyi at xsv.com.au>, ausnog at lists.ausnog.net 
Sent: Thursday, 18 December, 2014 3:20:24 PM 
Subject: Re: [AusNOG] DDoS impacting some Oz providers into Black Lotus LA? 

Is it possible that the user is multi-homed, and their other upstream is having them null routed to some upstreams? I’ve seen this happen before in this kind of scenario. 


-- 


Kind regards, 

Barry Murphy / Chief Operating Officer 


From: Shannon Gernyi < shannon.gernyi at xsv.com.au > 
Date: Thursday, 18 December 2014 4:26 pm 
To: " ausnog at lists.ausnog.net " < ausnog at lists.ausnog.net > 
Subject: [AusNOG] DDoS impacting some Oz providers into Black Lotus LA? 

Hi Noggers, 

It's a bit of a broad query at this stage, but I wanted to throw the question out there as we're seeing some interesting happenings when offloading traffic via Black lotus (US). 

DDoS appears to get scrubbed, but we're suddenly unable to access the victim's site from certain providers (iiNet, Exetel...), but can get there fine from others (Telstra). I don't have a lot of diagnostic information just yet, just wanted to query if anyone else is seeing similar issues or aware of anything. Trace stops before entering Black lotus from affected ISPs. 

Kind Regards, 

Shannon 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20141218/0851c240/attachment.html>