Re: New problem

From: James Murray (intdect@yahoo.com)
Date: 09/19/01 

Message-ID: <20010919214209.73884.qmail@web20208.mail.yahoo.com>
Date: Wed, 19 Sep 2001 14:42:09 -0700 (PDT)
From: James Murray <intdect@yahoo.com>
Subject: Re: New problem
To: Flynn Tom <tflynn@nyab.com>, 'Pedro Miller Rabinovitch' <pedro@cipher.com.br>, forensics@SECURITYFOCUS.COM

We are undergoing the same kind of problem. Ours is a
TCP SYN problem though. We are getting a DDOS of
about 9-12K pps to our mail server and web server. We
tried absorbing these packets with TCP Intercept on
our router, using our firewall, and also trying to use
a content switch, none of which worked. We finally
had to block all SYN packets to those two addresses at
our border router. When we did that our internet
connection came back.

--- Flynn Tom <tflynn@nyab.com> wrote:
> I am having some serious problems with our internet
> connection. TCP FIN
> scans are hitting our site and causing all sorts of
> troubles. Anyone heard
> of this or experiencing this? We have 3 locations
> in North America and all
> are experiencing similar problems.
>
>
>
>
>
> "The information contained in or attached to this
> message, to the extent it is non-public, is the
> confidential, proprietary information of New York
> Air Brake and may not be reproduced, disclosed to
> any third party or used by the recipient and/or the
> recipient's employer (hereinafter "recipient"), for
> other than the intended purpose for which it was
> provided to the recipient, without the prior written
> approval of New York Air Brake. These restrictions
> are in addition to any restrictions that may apply
> pursuant to the terms of any Confidentiality or
> Non-Disclosure Agreement(s) between New York Air
> Brake, its affiliates, and the recipient."
>

__________________________________________________
Terrorist Attacks on U.S. - How can you help?
Donate cash, emergency relief information
http://dailynews.yahoo.com/fc/US/Emergency_Information/