Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoS
Last month we shared statistics on some popular reflection attacks. Back then the average SSDP attack size was ~12 Gbps and largest SSDP reflection we recorded was:
- 30 Mpps (millions of packets per second)
- 80 Gbps (billions of bits per second)
- using 940k reflector IPs
This changed a couple of days ago when we noticed an unusually large SSDP amplification. It's worth deeper investigation since it crossed the symbolic threshold of 100 Gbps.
The packets per second chart during the attack looked like this:
The bandwidth usage:
This packet flood lasted 38 minutes. According to our sampled netflow data it utilized 930k reflector servers. We estimate that the during 38 minutes of the attack each reflector sent 112k packets to Cloudflare.
The reflector servers are across the globe, with a large presence in Argentina, Russia and China. Here are the unique IPs per country:
$ cat ips-nf-ct.txt|uniq|cut -f 2|sort|uniq -c|sort -nr|head
439126 CN
135783 RU
74825 AR
51222 US
41353 TW
32850 CA
19558 MY
18962 CO
14234 BR
10824 KR
10334 UA
9103 IT
...
The reflector IP distribution across ASNs is typical. It pretty much follows the world’s largest residential ISPs:
$ cat ips-nf-asn.txt |uniq|cut -f 2|sort|uniq Continue readingWorth Reading: The blue disco ball
The post Worth Reading: The blue disco ball appeared first on rule 11 reader.
As 5G Looms, Service Providers Need to Consider CGNAT
The 5G buzz is building and along with it are projections that some 5G networks will launch in 2018, with more widespread deployment in 2019. The launch of 5G networks will contribute to the large-scale proliferation of Internet of Things (IoT) devices.
Datanauts 090: AWS Networking Deep Dive
AWS and public cloud networking is not just VLANs. The Datanauts and guest Anthony Miloslavsky explore essential network constructs and architectural choices The post Datanauts 090: AWS Networking Deep Dive appeared first on Packet Pushers.
Cisco Vs Ruckus Wireless Systems
There is always a great tussle between Cisco and Ruckus on the wireless upfront where both the vendors are working hard to grip the market with the features they are providing in their wireless domain. Today I am going to talk about the head to head discussion of Cisco and Ruckus, Although there are lot of point which i am not going to cover here in this discussion.
Ruckus Wireless:
Ruckus wireless controllers address deployments of any size i.e. from a very small Field Sales Office to a Managed Service Provider solution. Clustered SCG 200s offer one of the highest scalability levels and are available in an appliance form factor as well as a virtual controller. EMS functions are built-in and integration via REST API is supported.
Full range of wireless controllers scaling from the entry level ZoneDirector 1200 which supports up to 75 AP’s, all the way up to the SmartCellTM Gateway controller which, with available clustering support, is capable of managing tens of thousands of AP’s and providing access for hundreds of thousands of mobile devices
Virtual SmartZone
High Scale (vSZ-H) - up to10,000 APs, up to 100,000 clients
vSZ-H cluster of 4 - up to 30,000 Continue reading
High Scale (vSZ-H) - up to10,000 APs, up to 100,000 clients
vSZ-H cluster of 4 - up to 30,000 Continue reading
Programming a Cisco Network Using Python
David Bombal demonstrates how to configure multiple Cisco switches using Python and GNS3.
New Petyawrap Ransomware Attack Again Highlights Critical Need For Security Processes
Whenever there's a new attack on a global scale, the world trusts the Internet a little less. Today we are concerned with the many reports about this new ransomware attack called "Petyawrap", "Petrwrap" or an older name of "Petya."
The sad fact is: this new attack exploits the same vulnerabilities in Windows systems as last month's WannaCry attack.
Fixes have been available for most Windows systems since March 2017!
The same tips Niel Harper provided last month to protect against ransomware also apply here.
Dan York
Patching Not Enough to Stop Petya
Voluminous amounts of information have already been disseminated regarding the “Petya” (or is it “NotPetya”? [1]) ransomware that hit the Ukraine hard [2] along with organizations such as “the American pharmaceutical giant Merck, the Danish shipping company AP Moller-Maersk, the British advertising firm WPP, Saint-Gobain […]Netscout Disaggregates Packet Broker Bundle for Open Compute Platforms
Netscout has been building its packet broker business through acquisitions.
Why Is My Network So Slow?
There are several ways to diagnose whether a problem exists on the network or the application.
Cisco Picks ExtraHop to Strengthen Tetration
ExtraHop is focused on understanding the context of multiple transactions from the network level.