[Tech-l] 9/23 network flooding incident

[Thor Sage]

Good morning,
Yesterday between approximately 10:30 and 10:50 a.m. MVECA experienced a network flooding incident in which massive numbers of out-of-order TCP packets pounded our HA firewall cluster causing severe latency and packet drops.  This incident is still under investigation and the source of this traffic has yet to be identified.  We are continuing to work on this and have implemented measures that will help identify the source of any additional events.  We have also escalated the incident to OARNet and our firewall manufacturer to try to get more analysis of log data associated with this traffic burst.  We are investigating this incident as potentially malicious and will also be escalating to CISA once we have additional data suggesting that this traffic was intentionally generated in order to disrupt network operations.  Because the volume of data generated during this incident is enormous, it is not an easy task to identify the exact source.  Work will continue and further updates will be provided.
Please know that MVECA prides itself on providing the highest quality network services available for schools and governments and we take this sort of thing very seriously.  Please bear with us as we continue to work to identify the cause of yesterday's incident.  Users may subscribe to our alert system at http://tec.mveca.org/tec/cpcl/mveca in order to receive real time information about all network operations and issues.
Thank you,
Thor

Thor Sage
Executive Director
Miami Valley Educational Computer Association
937-767-1468  x3101
[http://www.mveca.org/images/logo.gif]<http://www.mveca.org/>       [i] <https://www.linkedin.com/company/mveca/> [t] <https://twitter.com/mvecarcog>
Not-for-profit Technology Services for Education and Local Governments


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210924/8eb5e1e1/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 3184 bytes
Desc: image001.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210924/8eb5e1e1/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1229 bytes
Desc: image002.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210924/8eb5e1e1/attachment-0001.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 1197 bytes
Desc: image003.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210924/8eb5e1e1/attachment-0002.jpg>