Internet2 Network Security SIG

[Paul Howell <>]

Hi Michael,

There wasn't a graph attached.

Regards,
Paul

-----Original Message-----
From: 
<>
 on behalf of Michael H Lambert 
<>
Reply-To: 
""
 
<>
Date: Thursday, April 19, 2018 at 9:08 AM
To: 
""
 
<>
Subject: Re: [Security-WG] FWD: Alert (TA18-106A) Russian State-Sponsored 
Cyber Actors Targeting Network Infrastructure Devices

    Paul,
    
    > Here is a graph from syslog collection of discards from our core 
routers 
    > showing the number of discards per day.   The discard happens when the 
    > router is the destination for a packet but and the firewall filter 
    > discards instead of accepts the packet.  The graph shows a significant 
    > increase in discards from Russia beginning in early February.
    > 
    > This shouldn't come as a surprise given the advisory.
    > 
    > Others likely saw increased scanning from Russia.  If you did, would 
you 
    > be willing to share graphs or data on this?
    
    Do you have a sense of how much of the "unwanted" traffic came in over 
    the R&E network?
    
    Thanks,
    
    Michael
    
    -- 
    Michael H Lambert, GigaPoP Manager             Phone: +1 412 268-4960
    Pittsburgh Supercomputing Center/3ROX          FAX:   +1 412 268-5832
    300 S Craig St, Pittsburgh, PA  15213 USA