FYI: This is how a DNS attack reply profile looks like... (Seen via AMPR gateway, as someone uses YO addresses as the reply address) The reply amplification can be nicely seen for each attack sequence – targets are some hosts in China.
http://www.yo2loj.ro/files/dns_attack_replies.png
73s de Marius, YO2LOJ
Marius;
On Sat, 2015-12-26 at 17:26 +0200, Marius Petrescu wrote:
FYI: This is how a DNS attack reply profile looks like... (Seen via AMPR gateway, as someone uses YO addresses as the reply address) The reply amplification can be nicely seen for each attack sequence – targets are some hosts in China.
Not only have I seen these, but also ping floods. Moreso ping floods than DNS attacks on this side of the ocean... along with your typical botnet telnet/ssh probes.
-
Brian -
Marius Petrescu