Reporting Denial of Service attacks

Typical Denial of Service abuse (DoS) involves a very large number of connections or packets being directed to the target computer, either from a single source IP address or (Distributed Denial of Service, DDoS) from a number of addresses, possibly a large number and probably in several different networks. Sometimes the effect is to stop the data network working or make it so slow as to interfere with its normal use; sometimes the target is a single machine which also may cease to work or run very slowly. If the target is a single service such as a Web, DNS or e-mail server, it may be swamped by very many otherwise normal and legitimate requests for information.

Abuse from Janet addresses or domains

See the general guidance Reporting abuse originating from Janet for notes on which domains and IP addresses are part of Janet.

What to include in your report

In a Denial of Service it can be difficult to obtain complete information. Please include as much as possible of the following:

source IP address or addresses, both those in Janet and those in other networks;
destination IP address (in your network) and port or service;
date and time when the abuse started and finished (include your timezone and check whether your system clock was accurate at the time);
brief description of what happened;
any original log or trace information;
any other information you think may be helpful.

If it is available, a good sample of log information is all that is needed.

To get your report to Janet CSIRT see the general guidance Reporting abuse originating from Janet, which also explains how we will respond.

Abuse of Janet from outside

If you belong to a Janet organization and you believe your network has suffered Denial of Service abuse, please note the advice in Reporting abuse if you are a Janet user. Normally users should refer first to their local IT support or network staff.

The information required is the same as that described above where the abuse may have originated within Janet, but it is not always easy to decide where to send the report.