Ticket Number: HEA-NOC/20040804-4 Ticket Status: UPDATE
Ticket Type: unscheduled Resolver: EPA
Ticket Opened: 20040804 14:03 UTC+1 Problem Start: 20040804 13:50 UTC+1
Ticket Update: 20040805 09:33 UTC+1 Problem End:
Frank O'Brien von the EPA rang in to say that they are experiencing a DoS
on their Email server. He has received over 16000 emails to spurious
addresses @epa.ie. He has switched off the reception of emails and will
investigate further. The call was purely for information purposes and he
will update us. Will check Netflow to see if we can see where the attack
is coming from.
EPA mail service degraded
20040804 13:58 BC MRTG and Netflow reveal no large volumes of traffic. The
problem has been going all morning up until 12:45. All mails a re about
2kbytes but the sheer volume is causing the email server problems. EPA
uses a mail relay service from Messagelabs, so all mail traffic is
originating from 184.108.40.206. Frank has isolated some headers that are
common to most mails and will contact Messagelabs.
20040805 09:32 BN EPA are still working with Messagelabs to solve this
problem but their mail server is still offline. They will keep us updated
on the problem.
This ticket can be monitored at http://www.hea.net/tickets/20040804-4