Unplanned outage: Denial of Service attack 1100-1110

David Crowe, Jr. crowed at nero.net
Fri Apr 7 09:41:11 PDT 2006

At 0813 this morning we received yet another attack against the same
customer as the  The effects of this attack were similar to that of
wednesday except it happened right at the beginning of the work day.

We are continuing to try to identify the sources and destinations
involved in these ongoing attacks so we can further mitigate the

If you have any questions or concerns please don't hesitate to contact

phone: 541.346.6376
email: noc at nero.net

We sincerely apologize for the continued operational impact.


On Thu, 2006-04-06 at 01:50 -0700, David Crowe, Jr. wrote:
> At 2307 this evening, the gigabit ethernet interface on eugn-car2-gw
> that was involved in this attack earlier in the morning reset and didn't
> return in an operational state; this appears to have been a residual
> effect from the attack.  Traffic was restored around 2322 by clearing
> the interface again and forcing an update to the forwarding table.
> Unfortunately, this event occurred an hour before I was planning to make
> changes to reduce the collateral damage to Springfield Public Schools
> and the Medford and Klamath Falls Hub connected customers.  Those
> changes have now been made so those customers won't be impacted by this
> type of event in the future.
> David
> On Wed, 2006-04-05 at 12:14 -0700, Stephen Fromm wrote:
> > NERO experience a severe denial service attack against one of our
> > customers in Eugene between 1100 and 1110 this morning.  Unfortunately,
> > the high packet attack also resulted in collateral loss of connectivity
> > for other customers.
> > 
> > The affected customers included:
> > 
> > Lane ESD
> > City of Eugene 
> > RIS
> > Willamalane
> > Springfield Public Schools
> > Springfield Utility Board
> > All customers connected to Medford and Klamath Falls
> > 
> > All connectivity has since been restored.  Please let us know if you are
> > still experiencing problems.  We are presently evaluating changes to
> > limit the collateral damage of attacks in the future.
> > 
David Crowe, Jr.                        Email:      crowed at nero.net
Director, NERO Network                  Phone:      541.346.1698
UO Computing Center                     FAX:        541.346.4397
1225 Kincaid                            Cell:       541.912.1198
Eugene, OR 97401                        GPG Key ID: 9DEDD126

Fingerprint: 4860 7B9E D68F E95F 49CC  D074 CE8F 9483 9DED D126

More information about the outages mailing list