Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 24 Nov 2007 14:27:39 -0800
From:      Julian Elischer <julian@elischer.org>
To:        Jeff Mohler <speedtoys.racing@gmail.com>
Cc:        freebsd-hackers@freebsd.org, "Joel V." <joel@smail.ee>
Subject:   Re: Welcome to Hell / Mysterious networking troubles on FreeBSD
Message-ID:  <4748A55B.9030204@elischer.org>
In-Reply-To: <a969fbd10711241418g16ca72fbh21bd7de93c6c2757@mail.gmail.com>
References:  <000101c82ed9$4d0986b0$0200a8c0@windsor>	 <4748A0FA.1060402@elischer.org> <a969fbd10711241418g16ca72fbh21bd7de93c6c2757@mail.gmail.com>

next in thread | previous in thread | raw e-mail | index | archive | help
Jeff Mohler wrote:
> On Nov 24, 2007 2:08 PM, Julian Elischer <julian@elischer.org 
> <mailto:julian@elischer.org>> wrote:
> 
>     Joel V. wrote:
>      > Hello.
>      >
>      > A big thanks to everyone who contacted me. FreeBSD really has the
>     best
>      > community one could help for.
>      >
>      > Now, it has been confirmed by the backbone manager that we're
>     dealing with a
>      > DDOS attack. However, the ISP seems to be as clueless as a
>     headless sheep,
>      > and we haven't been able to contact their technical staff yet (of
>     course one
>      > can't be 100% sure that they even have a technical staff, judging
>     by the
>      > level of their response).
>      >
>      > Hopefully the situation will be fixed soon. One final question
>     though: are
>      > there any quick steps one can take to protect their server from
>     DDOS attacks
>      > like these?
> 
> 
> Well..call the people responsible for the source IP, complain to them as 
> well.
> 
> www.onlinehome-server.com <http://www.onlinehome-server.com>;  is the 
> provider.
> 
> Customer u15194704 is the problem computer.

OR the victim.

If I remember the thread correctly, it's only when he puts a nameserver
at that address that he has problems. That's because the damage is being caused by
the REPLIES he's making to that address.  His upload BW is less than his download 
BW. We have no guarantee that the packets are actually coming from that address
but could instead be spoofed, so that the victim is being swamped by replies 
from Joe's friend and others..

(I may have misremembered the beginning of the thread however)



> 
> 
> 
>  
> 




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4748A55B.9030204>