Unplanned outage: Denial of Service attack 1100-1110

David Crowe, Jr. crowed at nero.net
Thu Apr 6 01:50:03 PDT 2006

At 2307 this evening, the gigabit ethernet interface on eugn-car2-gw
that was involved in this attack earlier in the morning reset and didn't
return in an operational state; this appears to have been a residual
effect from the attack.  Traffic was restored around 2322 by clearing
the interface again and forcing an update to the forwarding table.

Unfortunately, this event occurred an hour before I was planning to make
changes to reduce the collateral damage to Springfield Public Schools
and the Medford and Klamath Falls Hub connected customers.  Those
changes have now been made so those customers won't be impacted by this
type of event in the future.


On Wed, 2006-04-05 at 12:14 -0700, Stephen Fromm wrote:
> NERO experience a severe denial service attack against one of our
> customers in Eugene between 1100 and 1110 this morning.  Unfortunately,
> the high packet attack also resulted in collateral loss of connectivity
> for other customers.
> The affected customers included:
> Lane ESD
> City of Eugene 
> Willamalane
> Springfield Public Schools
> Springfield Utility Board
> All customers connected to Medford and Klamath Falls
> All connectivity has since been restored.  Please let us know if you are
> still experiencing problems.  We are presently evaluating changes to
> limit the collateral damage of attacks in the future.

More information about the outages mailing list