Comcast/Level3 hit by minor DOS attack?

When I came home from the gym last night, I tried accessing Google, however it timed out. After suspecting my PC, and then my router, and finally my cable modem, I discovered the problem was much further away. A quick traceroute showed where the problem was:

raam@pluto:~$ traceroute google.com
traceroute: Warning: google.com has multiple addresses; using 64.233.167.99
traceroute to google.com (64.233.167.99), 30 hops max, 38 byte packets
1 192.168.2.200 (192.168.2.200) 1.816 ms 1.711 ms 1.718 ms
2 73.161.232.1 (73.161.232.1) 7.747 ms 7.374 ms 12.562 ms
3 ge-1-38-ur01.cambridge.ma.boston.comcast.net (68.87.151.137) 7.865 ms 8.434 ms 7.420 ms
4 te-8-1-ur02.cambridge.ma.boston.comcast.net (68.87.144.70) 8.473 ms 7.992 ms 7.890 ms
5 te-9-2-ur01.malden.ma.boston.comcast.net (68.87.144.73) 8.014 ms 18.855 ms 9.047 ms
6 te-8-1-ur02.malden.ma.boston.comcast.net (68.87.144.177) 8.101 ms 9.937 ms 8.489 ms
7 te-8-4-ar01.woburn.ma.boston.comcast.net (68.87.144.173) 8.477 ms 10.514 ms 8.416 ms
8 PO-10-ar01.foxboro.ma.boston.comcast.net (68.87.146.50) 9.407 ms 9.656 ms 10.243 ms
9 po-11-ar01.berlin.ct.hartford.comcast.net (68.87.146.33) 16.007 ms 12.353 ms 12.006 ms
10 po-10-ar01.chartford.ct.hartford.comcast.net (68.87.146.29) 13.468 ms 13.450 ms 13.957 ms
11 * * *
12 te-3-1.car1.NewYork1.Level3.net (4.71.172.109) 302.002 ms 301.466 ms 302.540 ms
13 ae-31-55.ebr1.NewYork1.Level3.net (4.68.97.158) 354.448 ms * ae-32-52.ebr2.NewYork1.Level3.net (4.68.97.62) 371.114 ms
14 ae-2.ebr1.Chicago1.Level3.net (4.69.132.65) 334.429 ms ae-1-100.ebr2.NewYork1.Level3.net (4.69.132.26) 376.366 ms ae-2.ebr1.Chicago1.Level3.n et (4.69.132.65) 325.988 ms
15 * * ae-11-55.car1.Chicago1.Level3.net (4.68.101.130) 326.044 ms
16 ae-11-51.car1.Chicago1.Level3.net (4.68.101.2) 323.914 ms GOOGLE-INC.car1.Chicago1.Level3.net (4.79.208.18) 322.442 ms 325.340 ms
17 66.249.94.133 (66.249.94.133) 325.499 ms 72.14.232.53 (72.14.232.53) 324.420 ms *
18 72.14.232.70 (72.14.232.70) 326.975 ms * 331.300 ms
19 64.233.175.26 (64.233.175.26) 321.481 ms py-in-f99.google.com (64.233.167.99) 320.482 ms *

As you can see from the bold line, the NewYork1.Level3.net server took a full 302.002 ms to go round trip. I tried to traceroute Google from other sites (online traceroute utilities) and they got through without any problem -- but that was because their route through the Internet didn't take them through those specific Level3 servers.

After 20 minutes or so, the problem seemed to clear up and a new traceroute showed a much more healthy response from te-3-2.car1.NewYork1.Level3.net: 11 te-3-2.car1.NewYork1.Level3.net (4.71.172.113) 14.475 ms 14.944 ms 15.518 ms

Write a Comment

Comment