RIPE NCC network affected by the DDoS attack (fwd)

Dear Colleagues,

You problably noticed this already through the delay alarms, but in case
you didn't:

---------- Forwarded message ----------
Date: Thu, 27 Feb 2003 18:18:25 +0100
From: Andrei Robachevsky <andrei at ripe.net>
To: local-ir at ripe.net, db-wg at ripe.net, dns-wg at ripe.net
Subject: [db-wg] RIPE NCC network affected by the DDoS attack

Dear Colleagues,

Starting from 14:00 UTC today, 27 February, RIPE NCC network suffered a
large DDoS attack. It was a distributed ICMP echo attack.

The attack caused various congestion related problems for the RIPE NCC's
network, to the extent that our BGP peering sessions were affected, and
non-ICMP traffic was being randomly dropped.

The attack was successfully mitigated with cooperation of our peer
networks at AMS-IX. Network condition returned back to normal at 16:30 UTC.

As a result some of our services, including www.ripe.net (web),
whois.ripe.net (RIPE Database), ns.ripe.net (DNS) and ftp.ripe.net (FTP)
were not accessible during this timeframe. Now all services are back to
normal.


Regards,

Andrei Robachevsky

-----------

ps.

We are currently looking at the data from both TTM and RIS and expect to
publish a more detailed report on our website late tomorrow or early
Monday morning.  In the meantime, take a look at:

http://tt01.ripe.net:10259/cgi-bin/multiple.cgi?all=all&delay=delay&loss=loss&RR
D_START=now-11hours&RRD_END=start%2B12h&RRD_W=-h100&RRD_H=-w350&RRD_L=0&RRD_R=1&
RRD_RIGID=-l0&LFORMAT=BOTH&Draw=Draw

which shows the delay between tt01.ripe.net, a test-box near our border
router and some 60 other hosts on the Internet.  You can clearly see
delays and losses going up around 2pm.

Kind regards,

Henk Uijterwaal

------------------------------------------------------------------------------
Henk Uijterwaal                             Email: henk.uijterwaal at ripe.net
RIPE Network Coordination Centre            WWW: http://www.ripe.net/home/henk
P.O.Box 10096          Singel 258           Phone: +31.20.5354414
1001 EB Amsterdam      1016 AB Amsterdam    Fax: +31.20.5354445
The Netherlands        The Netherlands      Mobile: +31.6.55861746
------------------------------------------------------------------------------

That problem that we weren't having yesterday, is it better? (Big ISP NOC)