On Monday 20 December 2021 at 17:19 UTC, a memcached amplification targeted a news publisher customer in Iberia. The attack peaked at 330.7 Gbps and lasted 73 minutes. Traffic originated from 2113 autonomous systems in 72 countries, predominantly a Mirai-derived IoT botnet.
| Vector | memcached amplification |
| Peak | 330.7 Gbps |
| Duration | 73 min |
| Time to mitigation | 0.349 s |
| Attack traffic reaching origin | 0.079% |
| Legitimate traffic challenged | 0.71% |
Timeline
The attack was preceded by a publicly announced sales event. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 13 points of presence.
What the customer saw
A brief increase in p99 latency of 30 ms during the first minute, then normal service.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Enable log streaming to your SIEM for faster correlation.
- Keep origin IPs out of public DNS history.
Clear and practical, thanks.
Good question. We will cover that in a follow-up post.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
Verified good bots and allow-listed partners bypass challenges entirely.
Any plans to support per-tenant limits keyed on a JWT claim?
Clear and practical, thanks.
Carpet bombing is nasty. Good to see a clear explanation of it.
Interesting that most attacks are under ten minutes. Our experience is similar.
Solid runbook advice. The DNS-at-2am point hit home.
Carpet bombing is nasty. Good to see a clear explanation of it.
Verified good bots and allow-listed partners bypass challenges entirely.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.