<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Another observation: do backbone servers apply any throttling of clients to keep them under control? If not, what's a reasonable throttle limit that won't break servers like ANSRVR, WHO-IS, CQSRVR, etc.?
<div><br></div><div>I'm wondering if the attacker is bouncing around because he's getting tossed off servers and has to reconnect.</div><div><br></div><div>Andrew, KA2DDO</div><br><br>-------- Original message --------<br>From: John Langner WB2OSZ <wb2osz@comcast.net> <br>Date: 4/30/20 10:49 (GMT-05:00) <br>To: aprssig@lists.tapr.org <br>Subject: [aprssig] UNDEFINED? <br><br>This looks like a deliberate attack, not an innocent accidental<br>misconfiguration.<br><br>It appears to be scanning thru a large number of T2 servers, around the<br>world. The location is bouncing all over the place, perhaps to thwart<br>duplicate removal and fill up the database.<br><br><br>At http://ontario.aprs2.net:14501/ we find:<br><br><br>187.210.189.241 UNDEFINED true gpserver corget.cn No filter<br>set 0d1h0m4.17s 121 2,402 7,676 184,425 21 512<br>0d0h0m4.249s<br><br>2400 packets per hour to the Ontario server alone. <br><br>This might be an attempt at a denial of service attack.<br><br><br><br><br>_______________________________________________<br>aprssig mailing list<br>aprssig@lists.tapr.org<br>http://lists.tapr.org/mailman/listinfo/aprssig_lists.tapr.org<br></body></html>