DoS Attack from Telecom NZ address 122.58.191.250

Forums › Spark New Zealand (including Skinny and BigPipe) › DoS Attack from Telecom NZ address 122.58.191.250

1 | 2

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#677822 27-Aug-2012 21:05

Hey guys,
Just to update you all. Everything has been going fine since the upgrade to 1gbps. We started getting alternative style attacks of lots of TCP SYN requests which clogged the CPU on the router. What I ended up doing is taking the target outside of the firewall and directly attached to the border router (since firewalling takes up a lot of CPU). All has been good since with about 1 attack greater than 300mbps doing nothing.

I am happy now :)

Speedtest 2019-10-14

frizianz

105 posts

Master Geek
+1 received by user: 1

#677925 28-Aug-2012 07:43

Zeon: Hey guys,
Just to update you all. Everything has been going fine since the upgrade to 1gbps. We started getting alternative style attacks of lots of TCP SYN requests which clogged the CPU on the router. What I ended up doing is taking the target outside of the firewall and directly attached to the border router (since firewalling takes up a lot of CPU). All has been good since with about 1 attack greater than 300mbps doing nothing.

I am happy now :)

Why not try fix it instead of bandaiding it?

Just my 2c.

frizianz.com || twitter.com/frizianz

mjb

996 posts

Ultimate Geek
+1 received by user: 67

Trusted

#677926 28-Aug-2012 07:52

frizianz: Why not try fix it instead of bandaiding it?

That was my exact thought after reading this thread for the first time last night..

contentsofsignaturemaysettleduringshipping

freitasm

BDFL - Memuneh
80655 posts

Uber Geek
+1 received by user: 41053

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#677930 28-Aug-2012 08:07

Zeon: Hey guys,
Just to update you all. Everything has been going fine since the upgrade to 1gbps. We started getting alternative style attacks of lots of TCP SYN requests which clogged the CPU on the router. What I ended up doing is taking the target outside of the firewall and directly attached to the border router (since firewalling takes up a lot of CPU). All has been good since with about 1 attack greater than 300mbps doing nothing.

I am happy now :)

Hmmm. So instead of getting this stopped you rather just waste bandwidth, put more resources that cost money?

There's a reason why abuse@telecom.co.nz and abuse@xtra.co.nz exist.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#677950 28-Aug-2012 08:51

freitasm:
Zeon: Hey guys,
Just to update you all. Everything has been going fine since the upgrade to 1gbps. We started getting alternative style attacks of lots of TCP SYN requests which clogged the CPU on the router. What I ended up doing is taking the target outside of the firewall and directly attached to the border router (since firewalling takes up a lot of CPU). All has been good since with about 1 attack greater than 300mbps doing nothing.

I am happy now :)

Hmmm. So instead of getting this stopped you rather just waste bandwidth, put more resources that cost money?

There's a reason why abuse@telecom.co.nz and abuse@xtra.co.nz exist.

Yep.. And if you need me to chase up you can e-mail me pl at telecom dot co dot nz and we can see what's going on.

However just because the source IP shows it from a Telecom IP address range doesn't necessarily mean it is. :( Such as things can be that source IP addresses can be spoofed using LOIC when someone wanted to DDos you.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#678022 28-Aug-2012 10:07

The rest of the attacks have been DDoS - not from a Telecom source specifically anymore. I went to the police but they declined to help...

Speedtest 2019-10-14

Apple TV

Stream your favourite shows now on Apple TV (affiliate link).

raytaylor

4076 posts

Uber Geek
+1 received by user: 1296

Trusted

#678205 28-Aug-2012 14:38

It is quite possibly a botnet.

I get them all the time - invalid logins from all sorts of ip addresses trying random logins on my email server.

We have the NZNOG (New Zealand Network Operator Group) mailing list hosted by the university of waikato.
You can often get in touch with a technical person with regard to things like botnet attacks by asking on the mailing list for a contact within a company. Its not really for average helpdesk enquiries, and more upper level technical issues such as tracking down offending users and inter-isp communication.

So if abuse@xtra didnt help, that would be the next place i would try.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

1 | 2