HE FMTII 核心路由器被D，已经接近3个小时了。

howie

哪个MJJ吃饱了撑着。。。

hkin

又挂了！！！

有个就好

默哀3分钟

zyzit

domin

主要是他们核心路由对抗DDOS有BUG
还是用Cisco或者Juniper吧
Brocade唉...

[ 本帖最后由 domin 于 2011-6-24 09:09 编辑 ]

howie

前几天有个帖子说在测试高防，打了16G的带宽？ 该不会是在测试高防，然后HE的路由器受不了了。

domin

可能攻击不是针对特定一个IP. WHT上说的是针对FMT2上随机几个IP.

howie

大致意思是美国太平洋时间9点左右，机房有个客人的设备被攻击，导致OSPF和BGP会话不断重载，占用了大量的CPU资源，降低路由器的性能。然后11点的时候，攻击流量有部分被转移到另外一个路由器上，11点半才完整转移所有攻击流量。

听说他们是是用了Broadcade / Foundry的设备，对D的处理机制不太好。我之前也想买个BigIron的核心交换机做BGP但是很多人说不好，小小攻击CPU就100%了，根本无法进去操作。
另外觉得奇怪的是，这么大的攻击干嘛不直接做BGP黑洞？

howie

Incident: Performance degradation due to DDOS on June 23rd

On June 23, 2011 starting at approximately 9:00a PST, the
Fremont 2 datacenter was subject to of a large sustained
DDOS targeting a customer.  The attack caused OSPF and
BGP reloads resulting in elevated CPU utilization and
performance degradation on the router.  The offending
customer was identified and was moved to a different
router. The attack was partially mitigated at
approximately 11:00a PST, and full containment was realized
at approximately 11:30a PST.  We are working with the
vendor regarding these attacks and hope to have a more
robust solution in place should we see a reoccurrence.

Hurricane Electric makes every effort possible to minimize
the impact of router hardware and software upgrades, we
apologize for the inconvenience.

Hurricane Electric Customer Care
+1.510.580.4120

Hurricane Electric Operations
+1.510.580.4100

This notification is intended for the addressee only. The
material may be privileged and may contain confidential
information. If you have received this notification in
error, please notify Hurricane Electric immediately via
email and delete the original.

[ 本帖最后由 howie 于 2011-6-24 08:07 编辑 ]

zyzit