Being DDOS'd

[Krewat]

I am getting DDOS'd daily using fragmented UDP packets. Who can I talk to to ask if this can be filtered by Verizon?

I am a FIOS business customer, but also a residential customer. My business line is getting the DDOS attacks.

Filtering fragmented UDP packets would stop this.

Thanks!

art k.

[CRobGauth]

I would believe that business customers have a different support vehicle than residential customers. Maybe check your bill for support info.

You can try to reach out via twitter @verizonsupport and see what their recommendation is.

[smith6612 · Accepted solution]

If you're being attackeed by IP addresses owned by Verizon and you know what they are, Verizon maintains contact information to their Security and Abuse department here: https://www.verizon.com/support/residential/account/manage-account/security/security-control-center. Otherwise, give Verizon a call and see if their support team will be able to relay your information off to a group which can assist.

From my past experience in dealing with an unexpected Denial of Service attack with another provider, typically the solution provided by the provider will be to change your IP address, or to wait it out. UDP attacks are a bit nasty because they are designed to either flood your bandwidth, consume all available sockets and resources on your gateway/firewall (thus preventing new connections in or out), or both.

Some other things to consider:

• Your router should not be responding to ICMP Pings from the entire Internet. If someone wants you offline, ping is the most obvious check. A botnet that is being tested (which I've seen happen on random IPs) for example might use this to see when the target goes offline. It's okay to allow ICMP Ping for monitoring, and you should use the firewall to restrict this behavior to certain IPs.
• UPnP is disabled. You don't want your network having devices open ports through the firewall on their own in a business environment.
• Your router's firewall is enabled in general, and is set to Drop, not Reject traffic. Active Rejection is as bad as responding to ICMP Pings when dealing with the Internet at large.
• Your devices themselves are secure - Remote access tools (TeamViewer, AnyDesk, etc) are behind a two factor authentication solution. Microsoft Remote Desktop is NOT exposed to the Internet, but protected behind a VPN. No malware on any system or undesirable software.