[Driftstörning] Re: Fwd: DoS->smitty.chl.chalmers.se [ChalmersIRT #5000]

[Gunnar Lindberg]

That filter has now been removed, at last.

	Gunnar Lindberg, ITS Nät/CDG & Chalmers IRT

>From lindberg at cdg.chalmers.se  Thu Nov  8 08:43:10 2007
>Date: Thu, 8 Nov 2007 08:43:10 +0100 (MET)
>From: Gunnar Lindberg <lindberg at cdg.chalmers.se>
>Message-Id: <200711080743.lA87hARq003914 at grunert.cdg.chalmers.se>
>To: driftstorning at lists.chalmers.se
>Subject: Fwd: DoS->smitty.chl.chalmers.se [ChalmersIRT #5000]
>Cc: abuse at chalmers.se
>In-Reply-To: <200711080717.lA87HIl3002588 at grunert.cdg.chalmers.se>

>Around 01:00 tonight, Thu 2007-11-08,

>   00:0e:0c:4e:5f:2e  129.16.214.5     smitty.chl.chalmers.se
>		       kerberos-1.chl.chalmers.se bdc.chl.chalmers.se

>begun to be the target of a DoS attack. It filled the 1 Gbit/s link
>to Lindholmen almost completeley.

>As a workaround we have filtered all incomming traffic to that hosts
>at our Internet boundry, so right now:

>    o	Link to Lindholmen is useful again.

>    o	Services on 129.16.214.5 cannot be accessed from the Internet.

>    o	Services on 129.16.214.5 that depend on Internet access will
>	not work at all or will perform poorly.

>We plan to remove the filters as soon as we see the input data rate
>drop to levels we can handle; at worst it was 6.8 Gbit/s in, right
>now it is 1.7 Gbit/s, which still too much.

>	Gunnar Lindberg, ITS Nät/CDG & Chalmers IRT