Initial Attack in September

• Site performance suffered
• Web server logs showed unusual pattern of hits
• Number of source addresses increased rapidly
• Quickly developed into SYN floods
• Solaris and firewall config unable to handle SYN floods
• Incoming traffic peak about 10Mbps, beyond the leased line's capacity
• Anonymous posters in alt.revisionism taunted webmasters about site availability