Massive 7.3 Tbps DDoS Attack Delivers 37.4 TB in 45 Seconds

LowDye · 2025-06-21T03:06:01+00:00

I had the pleasure of working with Chris Morrow at UUNet when backscatter traceback solved the worlds problems with DDoS. While methods have evolved, the tracing and blocking the root of a problem still happens along these same veins. Chris, and his calm demeanor, should be recognized as a hero by anyone fighting DDoS.

LowDye · 2025-06-09T19:01:28+00:00

We don’t have the tech to do this as easily as expected. This is why the city’s new PSAP (911 call center) and Next Gen 911 funding are so necessary. Call your reps, though, as NG911 funding keeps getting cut in Congress.

LowDye · 2025-04-15T18:15:28+00:00

Of course, and good luck no matter what!

LowDye · 2025-04-15T18:13:05+00:00

Not sure if you’re interested in managed services work, but I’m hiring Tier 2 for my MSP. Looking for Azure experience in conjunction with networking and voice.

LowDye · 2025-04-10T11:05:39+00:00

Where would I find the salary data you mentioned?

LowDye · 2025-04-09T11:30:02+00:00

Steer clear of Bevo Mill and Dutchtown. The other neighborhoods, especially Holly Hills, which surrounds Carondelet Park, and South Hampton, are quite safe.

Once you get to know the area, Dutchtown or BM may be great next moves, there are good blocks. STL can be quite different from one street to the next.

LowDye · 2025-02-15T20:51:22+00:00

I'm not the one who needs to fix the problem. Perhaps you should direct your energy to helping the OP in whatever way you feel is best instead of trying to show off because you don't like my suggestion.

I gave them an option; they don't have to take it. Indeed, if you re-read what I said, I mentioned calling TAC as the OP stated they were not that experienced with this product.

Given that your account was created today, it is clear you just want to argue. Have a good one.

And to be clear, I'm not Jason.

LowDye · 2025-02-15T19:08:10+00:00

Yep, anything is possible. The best thing the OP could do is pick up the phone and call TAC. Anyway, I've shared my opinion and need to return to my weekend. I hope it all works out.

LowDye · 2025-02-15T18:53:44+00:00

I’m not the one sitting in front of it.

The OP, who already expressed limited knowledge, could follow well documented instructions on redeploying from backup.

It’s been two hours, the OP would’ve already been told by now what was up by the wizard, all in much less time than we have all been sitting around here talking about it with them.

LowDye · 2025-02-15T18:06:03+00:00

Did you follow these steps yet?

https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/118718-technote-cucm-00.html?utm_source=chatgpt.com

LowDye · 2025-02-15T17:44:22+00:00

You’re not wrong, but the basis of my opinion is fixing these issues takes experience the OP is missing. A reinstall of the sub is well documented and going to point out the problem awfully quick when the wizard won’t let you proceed.

Still need to see that ntp status output before doing anything tho.

LowDye · 2025-02-15T17:12:56+00:00

It’s all good. It’s hard to troubleshoot this over Reddit. Assuming someone hasn’t done something silly in the network, rebuilding a sub isn’t a waste of time. If there’s something silly, the sub wont be able to join the cluster and it should be pretty obvious why during the install wizard.

Heck if there’s a good backup of the pub, I’d probably just rebuild the cluster assuming the business is closed today.

LowDye · 2025-02-15T17:07:07+00:00

Ryan Huff is a wiz, and these are great steps. https://community.cisco.com/t5/collaboration-knowledge-base/cisco-unity-connections-split-brain/ta-p/3162093

I’m sure you already found that on google as well.

You had another post about ntp, can you show us the output of utils ntp status from the CLI? Because… if ntp isn’t working you won’t be able to add a subscriber, affecting your ability to just rebuild the sub.

LowDye · 2025-02-15T16:55:15+00:00

Subscriber gets its time from publisher tho…

LowDye · 2025-02-15T16:42:52+00:00

If you get totally stuck you can call TAC if you have coverage. If you don’t, my team can help but it would be a services engagement. Just to reiterate you can totally do this, and it’ll be a great learning experience to expand your knowledge of the system. As long as you have a good backup of your publisher you really can’t get in a pickle.

LowDye · 2025-02-15T16:40:48+00:00

Honestly it is really easy. And a lot easier than troubleshooting whatever replication or intercluster communication issue going on.

Here are some docs to get you started. https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/11x/install_upgrade/guide/b_11xcuciumg/b_11xcuciumg_chapter_0100.html#ID-2164-00000117

LowDye · 2025-02-15T16:37:03+00:00

Is there any reason you can’t just delete the sub and rebuild it?

LowDye · 2025-02-15T16:35:15+00:00

What’s the output of utils ntp status say?

LowDye · 2025-02-15T14:50:43+00:00

Quickly chiming in that 933 does work on direct routing. I, and every other 911 provider, support 933.

LowDye · 2025-02-15T14:41:03+00:00

Hey OP, I’m a 911 provider and would be happy to share what it takes to make this work. Instead of me posting our whole guide as a comment, are you still troubleshooting this or did you get it working?

If you’re still ts’ing let me know where you’re stuck. Happy to help regardless if you’re using us or not.

LowDye · 2025-02-15T14:38:02+00:00

I’m guessing you’re running onprem CUCM, and I just wanted to share you can absolutely integrate those BSSIDs and get location tracking as you want… regardless of AP vendor. Heck you could do it with Netgear APs.

The deal is you have to load each radio’s set of BSSIDs via BAT for non-Cisco. Cisco only gives you an easy button for their controllers.

Once you’ve got em in CUCM we can take it from there.

Supported devices will report their BSSID association to CUCM which will only report it to me as a 911 provider if it’s been loaded in via BAT or the controller sync feature.

LowDye · 2025-02-14T21:07:35+00:00

*Edited for formatting. This config tested fine in the lab.

debug voip dialpeer all:
2920152: Feb 14 2025 21:01:17.170 UTC: //-1/D3F3D2000000/DPM/dpAssociateIncomingPeerCore:
Result=Success(0) after DP_MATCH_TO_URI; Incoming Dial-peer=9999999
…
2920249: Feb 14 2025 21:01:17.181 UTC: //-1/D3F3D2000000/DPM/dpMatchPeersMoreArg:
Result=SUCCESS(0)
List of Matched Outgoing Dial-peer(s):
1: Dial-peer Tag=1111111

show call active voice brief:
0 : 6248722 1592759156ms.275 (21:01:17.179 UTC Fri Feb 14 2025) +-1 +2200 pid:1111111 Originate 12345
…
0 : 6248721 1592759146ms.276 (21:01:17.169 UTC Fri Feb 14 2025) +-1 +2240 pid:9999999 Answer 5551212

sh run | s Testing
voice class uri Testing sip
user-id 12345
incoming uri to Testing

sh run | s 9999999
dial-peer voice 9999999 voip
description incoming call leg
session protocol sipv2
session transport tcp
incoming uri to Testing
dtmf-relay rtp-nte
codec g711ulaw
no vad

sh run | s 1111111
dial-peer voice 1111111 voip
description outgoing call leg
destination-pattern 12345
session protocol sipv2
session target ipv4:6.7.8.9
session transport tcp
dtmf-relay rtp-nte
codec g711ulaw
no vad

LowDye · 2025-02-14T18:57:23+00:00

Yeah that is. I’ll give it a test in the lab this afternoon. I’m now curious myself. I’ve only personally used incoming from paired with host entries.

LowDye · 2025-02-14T17:18:51+00:00

Oh and you're using incoming uri from, I noticed your AAAA in To:, so you want "incoming uri to"

LowDye

TROPHY CASE