It is interesting to read through the whole thread in a chronological order starting from the first message: http://mailman.nanog.org/pipermail/nanog/2016-Decem

It is interesting to read through the whole thread in a chronological order starting from the first message: http://mailman.nanog.org/pipermail/nanog/2016-December/089525.html http://mailman.nanog.org/pipermail/nanog/2016-December/08952... It took 4 days, to zero on the root cause. As is usual in a complex scenario like this there are a few false positives, some suspects abusing the protocol and alas final redemption. Amazing work by a dedicated group of technical folks in coordinating (just via emails, I suppose) and tracing the root cause.