RE: Protocol 17 floods from Vietnam & Mexico?

2017-09-14 Thread Matthew Smee
Protocol 17 likely refers to UDP. https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers -Original Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Large Hadron Collider Sent: Wednesday, 13 September 2017 11:08 AM To: nanog@nanog.org Subject: Protocol 17 floods from

Re: Protocol 17 floods from Vietnam & Mexico?

2017-09-13 Thread i mawsog via NANOG
om> To: Krunal Shah <ks...@primustel.ca> Cc: "nanog@nanog.org" <nanog@nanog.org> Sent: Wednesday, September 13, 2017 7:59 AM Subject: Re: Protocol 17 floods from Vietnam & Mexico? On Wed, Sep 13, 2017 at 9:59 AM, Krunal Shah <ks...@primustel.ca> wrote: &

Re: Protocol 17 floods from Vietnam & Mexico?

2017-09-13 Thread Christopher Morrow
; -Original Message- > From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Mark Andrews > Sent: Tuesday, September 12, 2017 10:45 PM > To: Large Hadron Collider > Cc: nanog@nanog.org > Subject: Re: Protocol 17 floods from Vietnam & Mexico? > > > In message <08ed

RE: Protocol 17 floods from Vietnam & Mexico?

2017-09-13 Thread Krunal Shah
It might be spoofed source IPs Krunal Shah -Original Message- From: NANOG [mailto:nanog-boun...@nanog.org] On Behalf Of Mark Andrews Sent: Tuesday, September 12, 2017 10:45 PM To: Large Hadron Collider Cc: nanog@nanog.org Subject: Re: Protocol 17 floods from Vietnam & Me

Re: Protocol 17 floods from Vietnam & Mexico?

2017-09-12 Thread Mark Andrews
In message <08ed2903-c81c-aa2e-cd04-4fa117840...@gmx.com>, Large Hadron Collider writes: > Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols. > > > On 12/09/2017 18:24, Matt Harris wrote: > > Protocol 17 is UDP. UDP is pretty common on the internet. Not sure > > why

Re: Protocol 17 floods from Vietnam & Mexico?

2017-09-12 Thread Large Hadron Collider
Yes, I'm being UDP flooded. I worked that out by grepping /etc/protocols. On 12/09/2017 18:24, Matt Harris wrote: Protocol 17 is UDP. UDP is pretty common on the internet. Not sure why source and destination ports aren't being shown by your tool there, might be malformed UDP packets designed

Re: Protocol 17 floods from Vietnam & Mexico?

2017-09-12 Thread Mark Andrews
Protocol 17 == UDP. These are just very big (65500 byte) UDP packets which have been fragmented. Somebody need to teach that packet analyser that UDP packets can be this big over IPv4 and bigger still if you are using IPv6 jumbo packets. Mark In message

Protocol 17 floods from Vietnam & Mexico?

2017-09-12 Thread Large Hadron Collider
18:04:32.391082 IP 138-122-97-251.internet.static.ientc.mx > umbrellix.net: ip-proto-17 18:04:32.391088 IP 138-122-97-251.internet.static.ientc.mx > umbrellix.net: ip-proto-17 18:04:32.391110 IP 115.75.50.106.35180 > umbrellix.net.10454: UDP, bad length 65500 > 1464 18:04:32.391145 IP