[NeMo-DDoS-List] FW: [Geant NeMo] #243489 END CRIT: IUCC (AS378) - "6 alerts" [Customer] [IUCC] [Email_Analysis]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Monday, April 20, 2026 5:16:07 AM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] #243489 END CRIT: IUCC (AS378) - "6 alerts" [Customer] [IUCC] [Email_Analysis]

Observed <= 0 alerts, closing.Alert closed.

Alert ID: 243489
Status: Closed
Severity: Critical

Start Time: 2026-04-20 01:48:48
End Time: 2026-04-20 02:15:54
Start Time (Europe/Berlin): 2026-04-20 03:48:48
End Time (Europe/Berlin): 2026-04-20 04:15:54
Duration: 28 min

First Event Seen: 2026-04-20 01:46:00
Last Event Seen: 2026-04-20 02:05:00
Event Count: 31

Trigger: Multiple Alerts (ID 31)

Alert Description:
Aggregated 6 alerts.

Affected Objects:
        Type              Name       Event Count
---------------------------------------------------
Autonomoussystem    IUCC (AS378)          31

Child Alerts:
  Alert ID                    Description
--------------------------------------------------------------
243488      High packet rate.
243490      High ACK packet rate.
243491      High TCP packet rate.
243492      High SYN packet rate.
243493      Abnormal ratio of SYN packets to ACK packets.
243487      Abnormal ratio of SYN packets to ACK packets.


Further Details:
https://secondary.nemo.geant.org/alerts/details/243489/

All times expressed in UTC.