Subject: Mail Flood Last Night

From: "Glen Barney (AMS)" <[email-masked]>
Date: Fri, 21 May 2010 09:12:09 -0700

All -

For the past several hours there have been delays in the processing of list
email.

The reason for this is a huge flood in the number of incoming messages to 
the system.  The flood was so signficiant that it may well have been the 
product of a coordinated attack of some kind, although I have no way to 
directly prove that.

Our mail queue normally has a delivery backlog of about 1,000 messages -
representing, over a 24-hour period, the number of messages that were not
immediately deliverable by our system.  The bulk of these are generally
responses by postconfirm asking for confirmation from addresses that were
forged (i.e., postconfirm doing its job.)

This morning we had a queue level of 16,500 messages, growing at the rate
of 100 additional messages every minute.  It didn't take long to find the
common thread among these messages and block the problem.

There will continue to be delays as the rest of our queue flushes out 
normally.  I will continue to monitor the situation and adjust it throughout
the next 12 hours to ensure that things continue to flow smoothly.

Thank you for your patience.

Glen Barney
IT Director
AMS (IETF Secretariat)