RE: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Steven Glogger
ilto:[EMAIL PROTECTED] On Behalf Of Goetz von Escher > Sent: Friday, April 11, 2008 3:56 PM > To: [EMAIL PROTECTED] > Subject: Re: [swinog] fw change on bluewin adsl accounts today? > > Hi all > > We notice a heavy DoS attack of TCP SYN packets to port 80 > since yesterd

Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Fredy Kuenzler
Schenkel Martin schrieb: Well, the only good solution to this ugly attack is to do what Goetz suggested; As an ISP inbound filter the offending IP address. This is what we did several hours ago and all is fine since then. BTW AS44066 which propagates the offending IP address claims spoofing.

RE: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Erich Hohermuth
the IP locally on the firewall. > > Martin > > > -Original Message- > > From: [EMAIL PROTECTED] [mailto:swinog- > > [EMAIL PROTECTED] On Behalf Of Olivier Mueller > > Sent: Freitag, 11. April 2008 16:05 > > To: [EMAIL PROTECTED] > > Subject: Re: [swinog] fw cha

RE: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Schenkel Martin
] > Subject: Re: [swinog] fw change on bluewin adsl accounts today? > > re, > > On Fri, 2008-04-11 at 15:16 +0200, Erich Hohermuth wrote: > > We also have a few customers complaining about connection troubles, most > > of them have a Zywal. After some netflow debugging we

Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Olivier Mueller
re, On Fri, 2008-04-11 at 15:16 +0200, Erich Hohermuth wrote: > We also have a few customers complaining about connection troubles, most > of them have a Zywal. After some netflow debugging we see many port 80 > syn connections which seems the cause of the troubles. Thanks for the feedback Erich!

AW: [Spam] Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Mike Kellenberger
-Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Mike Kellenberger Gesendet: Freitag, 11. April 2008 16:08 An: [EMAIL PROTECTED] Betreff: AW: [Spam] Re: [swinog] fw change on bluewin adsl accounts today? Yep, same here... http://service.escapenet.ch/mrtg

AW: [Spam] Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Mike Kellenberger
Skype mikek70atwork -Ursprüngliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Goetz von Escher Gesendet: Freitag, 11. April 2008 15:56 An: [EMAIL PROTECTED] Betreff: [Spam] Re: [swinog] fw change on bluewin adsl accounts today? Hi all We

Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Goetz von Escher
Hi all We notice a heavy DoS attack of TCP SYN packets to port 80 since yesterday 22:02 CEST directed against (random?) targets using a spoofed src ip from Munich (don't call the owner, call your upstream ISP and ask for proper filtering!). Lots of webservers and companies are affected. Some stat

Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Erich Hohermuth
Hello We also have a few customers complaining about connection troubles, most of them have a Zywal. After some netflow debugging we see many port 80 syn connections which seems the cause of the troubles. If someone needs a dump file, just send me a mail. Kind Regards Erich Am Freitag,

Re: [swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Ruben Merz
Hello Olivier, I have a similar setting to reach my box at home via an adsl from Bluewin. No problem on my side. Ruben Olivier Mueller wrote: Hello, Still trying to reach the swisscom/bluewin support since 10 minutes (and the robot keeps telling me "voraussichtliche warte zeit: 4-5 minuten"

[swinog] fw change on bluewin adsl accounts today?

2008-04-11 Diskussionsfäden Olivier Mueller
Hello, Still trying to reach the swisscom/bluewin support since 10 minutes (and the robot keeps telling me "voraussichtliche warte zeit: 4-5 minuten" all the time), so I guess it quicker if I ask here as well. It's a simple problem: I manage a few intranet boxes (mail/webproxy) connected to the