[AusNOG] NTP Reflection coming in over Equinix IX

[James Braunegg]

Dear Roland

Thanks for your fast reply  I'll email you the pcap file for an off line discussion would be interesting to see if different version of wire shark show different data... I looked on mine and could only find "length" not size....

Kindest Regards 

James Braunegg
P:  1300 769 972  |  M:  0488 997 207 |  D:  (03) 9751 7616
E:   james.braunegg at micron21.com  |  ABN:  12 109 977 666   
W:  www.micron21.com/ddos-protection   T: @micron21



This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.


-----Original Message-----
From: AusNOG [mailto:ausnog-bounces at lists.ausnog.net] On Behalf Of Dobbins, Roland
Sent: Friday, February 14, 2014 11:23 AM
To: ausnog at lists.ausnog.net
Subject: Re: [AusNOG] NTP Reflection coming in over Equinix IX


On Feb 14, 2014, at 7:04 AM, James Braunegg <james.braunegg at micron21.com> wrote:

> Have a read here for more information - http://www.micron21.com/ddos-ntp  would value your input on the wire shark capture which is "wild" attack traffic.

I'd need to see the pcap - I'm sitting here looking at multiple pcaps of 90 bytes.

Is it possible that the 'Length' field in the screenshot isn't overall packet length, but payload only?  My Wireshark doesn't have a 'Length' column, but rather a 'size' column . . .

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton

_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog