<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hi there and thank you. We have not performed traffic analysis yet via sniffers as the attacks suddenly stopped overnight.</div>
<div><br>
</div>
<div>That output is from Arbor Peakflow/TMS system.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Paul</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Ricardo David Carrillo Sanchez <<a href="mailto:dominus.ceo@gmail.com">dominus.ceo@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"Mailing list for CentOS mirrors." <<a href="mailto:centos-mirror@centos.org">centos-mirror@centos.org</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, August 5, 2014 at 11:00 PM<br>
<span style="font-weight:bold">To: </span>"Mailing list for CentOS mirrors." <<a href="mailto:centos-mirror@centos.org">centos-mirror@centos.org</a>><br>
<span style="font-weight:bold">Cc: </span>"Mailing list for CentOS mirrors." <<a href="mailto:centos-mirror@centos.org">centos-mirror@centos.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [CentOS-mirror] DDOS Attacks<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div><span id="mailbox-conversation">Which tool did you use to get this output, perhaps it is not an attack or do you have any kind of log to complement the output?</span>
<div class="mailbox_signature">—<br>
Sent from My mobile device<br>
</div>
<br>
<br>
<div class="gmail_quote">
<p>On Tue, Aug 5, 2014 at 8:01 PM, Paul Stewart <span dir="ltr"><<a href="mailto:pstewart@nexicomgroup.net" target="_blank">pstewart@nexicomgroup.net</a>></span> wrote:<br>
</p>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<p>Thanks for the input. This is new and just started today - it’s <br>
definitely an attack towards the server. We are seeing the exact same <br>
attacks now against other servers but all day until about an hour ago it <br>
was the CentOS mirror specifically (which may have just been dumb luck). <br>
If nobody else is seeing anything like this then that’s good news - the <br>
closest in the past that we have seen is Chinese IP addresses downloading <br>
the same ISO images over and over. This attack is seeing the source IP <br>
addresses worldwide (about 175 of them on average) indicating it’s botnet <br>
related likely. <br>
<br>
The attacks look like this: <br>
<br>
Type: TCP SYN Misuse <br>
ID: 198828 <br>
Resource: xx.xxx.xx.2/32 Other <br>
Router: Not Applicable <br>
Interface: Not Applicable <br>
Severity: high <br>
Impact: 662.58 Mbps/93.27 Kpps <br>
Started: 2014-08-05 23:55:40 <br>
Ended: 2014-08-06 00:02:41 <br>
Link rate: 93.27 Kpps, 186.530000% of 50.00 Kpps <br>
Protocol: tcp <br>
Flags: S <br>
Router: xx.xx.xxx.59 (core1.xxxxxxxxx) <br>
Input If.: 694 (xe-4/2/0.101) <br>
Output If.: 604 (xe-2/3/0.0) <br>
URL: <a href="https://xxxxxxxxxxxxxxxxxxxxxxxxxxx">https://xxxxxxxxxxxxxxxxxxxxxxxxxxx</a>
<br>
<br>
Thanks, <br>
<br>
Paul <br>
<br>
<br>
<br>
<br>
On 2014-08-05, 7:24 PM, "Anssi Johansson" <<a href="mailto:centos@miuku.net">centos@miuku.net</a>> wrote:
<br>
<br>
>6.8.2014 1.59, Paul Stewart kirjoitti: <br>
>> Hi there… <br>
>> <br>
>> Today, we started getting hit with DDOS attacks specifically against our <br>
>> CentOS mirror. Has anyone else seen this behavior before? <br>
>> <br>
>> These are TCP SYN and TCP RST misuse type attacks. <br>
> <br>
>I don't run a mirror myself, but please note that what you're seeing <br>
>might be simply yum-plugin-fastestmirror doing what's it's supposed to <br>
>do. yum-plugin-fastestmirror determines the closest mirror by opening a <br>
>TCP connection to each mirror and then closing the connection <br>
>immediately. The time spent is measured, and the fastest mirror as <br>
>determined by this process gets selected. <br>
>_______________________________________________ <br>
>CentOS-mirror mailing list <br>
><a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a> <br>
><a href="http://lists.centos.org/mailman/listinfo/centos-mirror">http://lists.centos.org/mailman/listinfo/centos-mirror</a>
<br>
<br>
_______________________________________________<br>
CentOS-mirror mailing list<br>
<a href="mailto:CentOS-mirror@centos.org">CentOS-mirror@centos.org</a><br>
<a href="http://lists.centos.org/mailman/listinfo/centos-mirror">http://lists.centos.org/mailman/listinfo/centos-mirror</a><br>
</p>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
</span>
</body>
</html>