[afnog] any experience combating a DRDoS attack?

[McTim]

Hi all,

Some folk in Macedonia are in a world of hurt, getting hit daily btwn
11 a.m.  and 4 p.m.

I've sent them all the links I can find:

http://grc.com/dos/grcdos.htm
http://www.fourmilab.ch/documents/security/incidents/ddos_2004-01/
http://www.ripe.net/ripe/meetings/ripe-50/presentations/ripe50-plenary-tue-ddos.pdf

I've pointed them to the NANOG list archives, and advised them to
filter, set up a honeypot and even change IP blocks (as they are being
filtered by much of the world becasue of cyberfraud).

At this point, I know nothing aboout their network (except they are
getting hammered and are fairly clueless).  Any other clues I can give
him?

--
Cheers,

McTim
$ whois -h whois.afrinic.net mctim