DoS

There are 2 posts tagged DoS (this is page 1 of 1).

DoS Attack Causing Problems on AT&T Network

There seems to be a DOS attack causing problems for connections routing through AT&T's network. Here is a notice from the datacenter that host's my web hosting server:

A large inbound Denial of Service attack is saturating connections to one of our providers. As a result some inbound traffic (that which gets routed over that provider) is experiencing high latency and timeouts. All other providers are fully functional, the routing is handled by the source network as such the issue will appear inconsistently across client connections. We are working with the affected provider to block the attacks and hope to have it resolved as soon as possible.

If you're interested, here are the traceroute results.

I think this explains why I was having so many problems with my Verizon FiOS connection at home this morning. I was cursing Verizon left and right wondering why I couldn't connect to half the Internet!

Comcast/Level3 hit by minor DOS attack?

When I came home from the gym last night, I tried accessing Google, however it timed out. After suspecting my PC, and then my router, and finally my cable modem, I discovered the problem was much further away. A quick traceroute showed where the problem was:

raam@pluto:~$ traceroute google.com
traceroute: Warning: google.com has multiple addresses; using 64.233.167.99
traceroute to google.com (64.233.167.99), 30 hops max, 38 byte packets
1 192.168.2.200 (192.168.2.200) 1.816 ms 1.711 ms 1.718 ms
2 73.161.232.1 (73.161.232.1) 7.747 ms 7.374 ms 12.562 ms
3 ge-1-38-ur01.cambridge.ma.boston.comcast.net (68.87.151.137) 7.865 ms 8.434 ms 7.420 ms
4 te-8-1-ur02.cambridge.ma.boston.comcast.net (68.87.144.70) 8.473 ms 7.992 ms 7.890 ms
5 te-9-2-ur01.malden.ma.boston.comcast.net (68.87.144.73) 8.014 ms 18.855 ms 9.047 ms
6 te-8-1-ur02.malden.ma.boston.comcast.net (68.87.144.177) 8.101 ms 9.937 ms 8.489 ms
7 te-8-4-ar01.woburn.ma.boston.comcast.net (68.87.144.173) 8.477 ms 10.514 ms 8.416 ms
8 PO-10-ar01.foxboro.ma.boston.comcast.net (68.87.146.50) 9.407 ms 9.656 ms 10.243 ms
9 po-11-ar01.berlin.ct.hartford.comcast.net (68.87.146.33) 16.007 ms 12.353 ms 12.006 ms
10 po-10-ar01.chartford.ct.hartford.comcast.net (68.87.146.29) 13.468 ms 13.450 ms 13.957 ms
11 * * *
12 te-3-1.car1.NewYork1.Level3.net (4.71.172.109) 302.002 ms 301.466 ms 302.540 ms
13 ae-31-55.ebr1.NewYork1.Level3.net (4.68.97.158) 354.448 ms * ae-32-52.ebr2.NewYork1.Level3.net (4.68.97.62) 371.114 ms
14 ae-2.ebr1.Chicago1.Level3.net (4.69.132.65) 334.429 ms ae-1-100.ebr2.NewYork1.Level3.net (4.69.132.26) 376.366 ms ae-2.ebr1.Chicago1.Level3.n et (4.69.132.65) 325.988 ms
15 * * ae-11-55.car1.Chicago1.Level3.net (4.68.101.130) 326.044 ms
16 ae-11-51.car1.Chicago1.Level3.net (4.68.101.2) 323.914 ms GOOGLE-INC.car1.Chicago1.Level3.net (4.79.208.18) 322.442 ms 325.340 ms
17 66.249.94.133 (66.249.94.133) 325.499 ms 72.14.232.53 (72.14.232.53) 324.420 ms *
18 72.14.232.70 (72.14.232.70) 326.975 ms * 331.300 ms
19 64.233.175.26 (64.233.175.26) 321.481 ms py-in-f99.google.com (64.233.167.99) 320.482 ms *

As you can see from the bold line, the NewYork1.Level3.net server took a full 302.002 ms to go round trip. I tried to traceroute Google from other sites (online traceroute utilities) and they got through without any problem -- but that was because their route through the Internet didn't take them through those specific Level3 servers.

After 20 minutes or so, the problem seemed to clear up and a new traceroute showed a much more healthy response from te-3-2.car1.NewYork1.Level3.net: 11 te-3-2.car1.NewYork1.Level3.net (4.71.172.113) 14.475 ms 14.944 ms 15.518 ms