Internet2 Network Security SIG

[Paul Howell <>]

My bad, I misunderstood your message, I thought you were sharing a similar 
graph of what you saw.

Some quick checking showed mostly TRCPS.

-----Original Message-----
From: 
<>
 on behalf of Paul Howell 
<>
Reply-To: 
""
 
<>
Date: Thursday, April 19, 2018 at 9:27 AM
To: 
""
 
<>
Subject: Re: [Security-WG] FWD: Alert (TA18-106A) Russian State-Sponsored 
Cyber Actors Targeting Network Infrastructure Devices

    Hi Michael,
    
    There wasn't a graph attached.
    
    Regards,
    Paul
    
    -----Original Message-----
    From: 
<>
 on behalf of Michael H Lambert 
<>
    Reply-To: 
""
 
<>
    Date: Thursday, April 19, 2018 at 9:08 AM
    To: 
""
 
<>
    Subject: Re: [Security-WG] FWD: Alert (TA18-106A) Russian State-Sponsored 
Cyber Actors Targeting Network Infrastructure Devices
    
        Paul,
        
        > Here is a graph from syslog collection of discards from our core 
routers 
        > showing the number of discards per day.   The discard happens when 
the 
        > router is the destination for a packet but and the firewall filter 
        > discards instead of accepts the packet.  The graph shows a 
significant 
        > increase in discards from Russia beginning in early February.
        > 
        > This shouldn't come as a surprise given the advisory.
        > 
        > Others likely saw increased scanning from Russia.  If you did, 
would you 
        > be willing to share graphs or data on this?
        
        Do you have a sense of how much of the "unwanted" traffic came in 
over 
        the R&E network?
        
        Thanks,
        
        Michael
        
        -- 
        Michael H Lambert, GigaPoP Manager             Phone: +1 412 268-4960
        Pittsburgh Supercomputing Center/3ROX          FAX:   +1 412 268-5832
        300 S Craig St, Pittsburgh, PA  15213 USA