[isp-bgp] Re: Suggested solution to prevent my prefixes frombeing suppressed (fwd)

[Pete Templin <petelists@...>]

Ton Schoenmakers wrote:

> Dou you have a single IP attacked, or the whole prefix that you advertise?
> This is important, because if it is a single IP, you simply ask your ISP 
> to block traffic to this IP until the attack is over. All ISP's will 
> (read: should) do that for you, and some will even be capable to track 
> down the real source of the attack, even when spoofed (UUNet has 
> implemented a wonderful tool for this. It is capable of tracking and 
> blocking malicious traffic in 5 minutes on their backbone network 
> (AS701) ).
The good thing is any network can deploy this.  There's documentation 
available to help.  Look for real-time blackhole filtering.

> If you block it yourself at your routers (firewalls), it is too late.  
> They have already consumed your bandwith.  Go for an OC3, I have not 
> seen DoS attacks that could saturate those babies.....
Ha!  We got slammed two weeks ago by supposedly 380Mbps.  Let's just say 
it really hurt.  All to one address.

pt

       _____________________________________________________

       ** ISPCON Fall 2004 - Santa Clara Convention Center **
        ** The ISP and WISP event - http://www.ispcon.com **
** Fill your brain.  Meet the people.  Join the industry gathering. **
      ________________________________________________________






To unsubscribe via postal mail, please contact us at:
Jupitermedia Corp.
Attn: Discussion List Management
475 Park Avenue South
New York, NY 10016

Please include the email address which you have been contacted with.