[AusNOG] NTP Reflection coming in over Equinix IX

[McDonald Richards]

Might be an idea to capture and get the top source hosts so admins can be contacted.

Macca



On 13 Feb 2014, at 3:42 pm, "Sean K. Finn" <sean.finn at ozservers.com.au<mailto:sean.finn at ozservers.com.au>> wrote:

Hey All,

I never thought I’d see the day, we’re seeing local NTP Reflection attacks come in across Equinix peering!

Thankfully they are very small amounts of traffic but you can see the traffic jump percentage wise.

<image001.png>


Does anyone have any mitigation stategies across the Equinix IX . (Apart from obvious, i.e. contacting the peer AS’s to asking them to nice mitigate at their end and pray, or droping prefix from Equinix completely.)

PS Anyone else on Equinix Syd if you’re smashing outbound on NTP please check :)


This is the first time we’ve seen reflection attack across peering!

What I once considered safe harbour has now been compromised.

Kind Regards,
Sean Finn,
Oz Servers.


________________________________
Premium Australian Hosting Solution Specialists
________________________________
Sean Finn, BInfTech(NetSys)Qld.UT
Oz Servers
e: sean.finn at ozservers.com.au<mailto:sean.finn at ozservers.com.au>
w: http://www.ozservers.com.au<http://www.ozservers.com.au/>
p: 1300 13 89 69



<image002.gif>


_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net<mailto:AusNOG at lists.ausnog.net>
http://lists.ausnog.net/mailman/listinfo/ausnog
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140213/b91f0030/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 23838 bytes
Desc: image001.png
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140213/b91f0030/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.gif
Type: image/gif
Size: 2556 bytes
Desc: image002.gif
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140213/b91f0030/attachment-0001.gif>