<div dir="ltr"><div><br></div><div>I was able to run Unix OPENBGPD platform and Snort IDS to highly supress the attack.</div><div><br></div><div>Meanwhile i will take note of the contributions mentioned earlier and try it out.</div><div><br></div><div>Also, my ISP said I should get a perimeter firewall like the Cisco ASA 5500 series.</div><div><br></div><div>Thanks to everyone.<br></div><div><br></div><div>Warm Regards.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 25, 2016 at 10:44 AM, Dewole Ajao <span dir="ltr"><<a href="mailto:dewole@tinitop.com" target="_blank">dewole@tinitop.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Sorry, we're 4 days late to the rescue... Dropping the incoming DNS
traffic will fix it but tomorrow it will be some other service so
ideally you should filter out access to all local services from your
WAN interfaces. Wrote
<a href="http://dewoleajao.com/blog2/remote-rogues-spoiling-your-web-experience" target="_blank">http://dewoleajao.com/blog2/remote-rogues-spoiling-your-web-experience</a>
last year after seeing same at many Mikrotik all-in-one router
sites.<br>
<br>
And you should join
<a href="http://abuja.forum.org.ng/mailman/listinfo/ngnog-discuss" target="_blank">http://abuja.forum.org.ng/mailman/listinfo/ngnog-discuss</a> too ;-)<br>
<br>
All the best!<span class="HOEnZb"><font color="#888888"><br>
Dewole. <br></font></span><div><div class="h5">
<br>
<div>On 2/21/2016 11:24 PM, Folarin
Oluwafemi wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div style="font-size:12.8px">Hello Group Members,</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">I recently did BGP peering with my
upstream provider and everything was fine until a few days </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">time when i observe strange
traffic from the interface of my WAN.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">What i saw using torch tool
(network real-time monitor) on Mikrotik was traffic hitting my
WAN</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">interface from IP prefix from
unknown locations hitting my router for DNS service that i
can't </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">explain..</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">I disabled my LAN Public IP block
of <a href="http://196.13.111.0/24" target="_blank">196.13.111.0/24</a> and observed keenly the
scenario and still </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">observed high traffic coming in.</div>
<div style="font-size:12.8px"> </div>
<div style="font-size:12.8px">Because of this act, i have not
been able to enjoy good internet service from my provider.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">Any filtering mechanism that can
be used or how this attack can be mitigated.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">Attached is the snapshot of what
am refering to.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px"><b>ETHER 5 is the interface facing
my ISP </b></div>
<div style="font-size:12.8px"><b><br>
</b></div>
<div style="font-size:12.8px"><b>ETHER 3 is my LAN interface <a href="http://196.13.111.0/24" target="_blank">196.13.111.0/24</a> disabled<br clear="all">
</b>
<div><br>
</div>
</div>
<div><span style="font-size:12.8px">I need assistance from the
group in helping out.</span><br>
</div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Regards.</span></div>
-- <br>
<div><font style="color:rgb(0,0,0)" size="2"><span style="font-family:Tahoma;font-weight:bold">I
am what God says I am<br>
</span></font></div>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><span class=""><pre>_______________________________________________
afnog mailing list
<a href="https://www.afnog.org/mailman/listinfo/afnog" target="_blank">https://www.afnog.org/mailman/listinfo/afnog</a></pre>
</span></blockquote>
<br>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><font style="color:rgb(0,0,0)" size="2"><span style="font-family:Tahoma;font-weight:bold">I am what God says I am<br></span></font></div>
</div>