[46509] in North American Network Operators' Group
Re: Economics of flooding
daemon@ATHENA.MIT.EDU (Basil Kruglov)
Tue Apr 2 14:42:13 2002
Date: Tue, 2 Apr 2002 13:51:54 -0600
From: Basil Kruglov <basil@cifnet.com>
To: nanog@merit.edu
Message-ID: <20020402195154.GA63599@shell.cifnet.com>
Reply-To: nanog@merit.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3CA9F342.3060803@reactivenetwork.com>
Errors-To: owner-nanog-outgoing@merit.edu
On Tue, Apr 02, 2002 at 10:06:58AM -0800, Livio Ricciulli wrote:
> Is anyone aware of a process for claiming a deduction in charges when
> fees are associated with a flooding attack?
> In particular, attacks may push up the 95% usage or (more commonly)
> attacks may create prolonged
> loss of network availability; Both outcomes may result in a claim for
> deduction.
This goes to big-boys - it's easier to kick the customer out
then to deal with it, especially if you're running an irc server or similar
things like customers hosting shells/bots/etc.
> Has anyone ever dealt with something like this? How is this handled
> today? What evidence or proof has
> to be provided to get the deductions (if any)?
In general, if you say commit to say 20-30Mbps+ on 95th % up to 100Mbps
burstable, they will ask how often those attacks happen, if it's <5-10 a
month, then it's nothing, regardless how hard you get hit, just make sure
to give them a call and request filters if it's above your 95th % line.
If you get 5+ weekly or *daily* and if NSP cannot put some semi-permanent
solution, other than some pathetic 24h policy or alike, then eventually
they *will* stop working with you. They have other customers and issues
attend to and they will not break the 24h-acl policy rule for just one
customer.
If those attacks overrun their pipes or cpu in routers, thus causing the
downtime, downtime = SLA credits to other customers; and if they can't work
with their peers/transits or peers/transits refuse to work with
your NSP, then at some point they will stop working with you or/and kick
you out per contract/AUP - been there, done that.
Of the top of my head, not UUnet, C&W, Sprint, Genuity, Exodus, Globix,
Verio, to name a few, will go thus far to fix the billing issue, they have
different chain of people working at each level/department, they might bend
once but that's as far as it goes. 9 out of 10 times they'll ask you to
commit to more transit or/and get a flat pipe.
It's about making $ at the end, always, never forget.
-Basil
