[AG-TECH] AG DoS?

[Robert Olson]

do you have any information on source addresses, or if the traffic was 
valid media data?

--bob


At 06:55 PM 1/23/2002 -0600, Michael Grobe <grobe at raven.cc.ku.edu> wrote:
>to follow up on jeff's note....our network guys have now characterized
>the high-traffic event experienced on jan 23, 2002 as:
>
>      "...a large burst of traffic seemed to occur every half hour
>      from the times we were monitoring from 2:00 - 5:00 (CST)."
>
>and they have linked the event to a number of remote AG systems which
>were probably in the Lobby....and, possibly, to some non AG systems.
>investigation continues.
>
>:michael grobe
>university of kansas
>
> > Did anyone else happen to notice what would like a huge DoS atack
> > between about 4:30 and 5:00 PM U.S. CST today (Jan. 23)?  Our campus was
> > suffering from huge problems with internet connectivity and one of our
> > network folks saw something in a router that made him think it might
> > have something to do with AG as the address was one of the multicast
> > addresses for the Lobby.  When we shut down our AG node(s) the problem
> > suddenly disappeared.  Now we'd like to try and find out if it was pure
> > coincidence or if was somehow AG related.  Our network guy said the
> > traffic looked like huge (30KB?) UDP packets.  So did anyone else notice
> > problems during this timeframe?
> >
> > Jeff Long
> > University of Kansas
> >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mcs.anl.gov/pipermail/ag-tech/attachments/20020123/183f00bb/attachment.htm>