User: DavidMoore

Re:Net Telescope

On: Analysis of the Witty Worm

Last time I checked, there were over 70 /8s
without any assigned addresses. There isn't a lack of addresses, but partially that is because everyone worked hard to reduce the rate at which they were being given out.

Re:an inside job?

On: SCO Not Lying About DoS Attack

The graphs suggest that the bandwidth was only consumed for couple hour periods in the night time, with the majority of the time just being under a lower rate SYN flood loading the servers more than the links.

Re:SCO Not lying...

On: SCO Not Lying About DoS Attack

The peaks are large, but the majority of the time the load is much lower. 4,000 pps syn flood is under 1.5 Mbit/sec. So plenty of room for other traffic. SCO had both bandwidth problems from having a relatively small pipe and server load from the syn flood.

Correct URL

On: SCO Not Lying About DoS Attack

CAIDA Analysis of SCO DoS Please use this link, the other one goes to a slow XML server.

Re:Backscatter

On: Security Experts Doubt SCO's Claims of DoS

CAIDA Backscatter Analysis of SCO Attack

CAIDA Analysis of SCO DoS Attack

On: Security Experts Doubt SCO's Claims of DoS

At 3:20 AM PST on Wednesday, December 10, 2003, the CAIDA Network Telescope began to receive backscatter traffic indicating a distributed denial-of-service attack against the SCO Group. Early in the attack, unknown perpetrators targeted SCO's web servers with a SYN flood of approximately 34,000 packets per second. Around 2:50 AM PST Thursday morning, the attacker(s) began to attack SCO's ftp (file transfer protocol) servers in addition to continuing the web server attack. Together www.sco.com and ftp.sco.com experienced a SYN flood of over 50,000 packet-per-second early Thursday morning. By mid-morning (Thursday December 11, 9 AM PST), the attack rate had reduced considerably to around 3,700 packets per second.

For more information (and graph of attack), see CAIDA's writeup.