Skip to main content
FastNetMon detects 38 Gbps of UDP reflection traffic aimed at one of the ISP’s hosted customer prefixes. The NOC needs to confirm the attack, activate upstream mitigation with the ISP’s transit providers, protect the rest of the subscribers without blackholing the victim unnecessarily, and keep the customer informed so they don’t see their own website blackholed and open a panic ticket. Assign the agent the coordination loop: assemble attack and customer-impact evidence, obtain the incident owner’s decision, track the approved mitigation, and keep the customer response current until service is verified. The network changes below need the appropriate execution path and authorization; define them as explicit actions or handoffs in the support loop.

​
Systems involved

​
Technical playbook

1

Confirm the attack signature

FastNetMon raises the alarm. Copilot pulls the NetFlow top-flows, confirms UDP reflection on source ports 123 and 11211, and identifies the destination prefix — a single /28 hosted for a customer named ACME Gaming.
2

Decide the mitigation posture

The prefix is hosting live game-matchmaking. RTBH blackholes the customer, which is the attacker’s goal. Copilot proposes transit scrubbing first, flowspec policer second, RTBH last-resort — and lists the phone numbers for each transit provider’s NOC.
3

Engage transit scrubbing

Through the Lumen scrubbing connector, request diversion for the affected /28. Cogent has no connector yet — Copilot drafts the email template with attack signature, prefix, customer identifier, and contact phone.
4

Push flowspec at the edge

SSH to the core routers. Stage the flowspec rule: drop UDP/123 and UDP/11211 traffic to the victim prefix. Approval prompt shows the exact match and action. Push and monitor.
5

Notify the customer

Copilot pulls the customer’s technical contact from Splynx and drafts a short email through Gmail: attack detected, scrubbing active, their service may see brief rerouting, the NOC is monitoring, next update in 30 minutes. Sent.
6

Internal channel

Assign an operator to maintain the incident thread in #security with the timeline, flow samples, scrubbing status, customer contact state, and escalation tree. Use configured Slack human-task routing for worker decisions where available; incident-wide automatic posting requires a separately supported and configured integration.
7

Monitor effectiveness

Copilot watches the FastNetMon attack-graph and the core-router interface counters. Scrubbing brings the attack from 38 Gbps to 180 Mbps of legitimate traffic within six minutes.
8

De-escalate

When the attack falls below the policer threshold for 15 minutes, withdraw the scrubbing diversion, remove the flowspec rule in reverse order, and validate the customer’s service is normal. Send the customer the all-clear email.
9

Post-event report

Generate a Markdown attack-event report: timeline, peak bps and pps, signature, mitigations applied, effectiveness curve, recommendations. Attach to the internal ticket and email to the customer for their records.

​
Support outcome

  • The mitigation decision, customer impact, and actions taken are documented in the incident.
  • The customer receives current updates while the response team verifies the service result.
  • The resolution record includes recovery evidence, remaining risks, and any owned follow-up.

AI Copilot

Keep Planning mode on while DDoS decisions are active — every action deserves a visible approval.

Connectors and MCP

FastNetMon, transit scrubbing portals, and Splynx as connector calls.