I should probably know this info but managed to forget it since the site I run has to be placed outside these devices (our everyday traffic is almost indistingu

I should probably know this info but managed to forget it since the site I run has to be placed outside these devices (our everyday traffic is almost indistinguishable from a DDoS.) In fact, that might tell you something, since our Chicago data center was taken out as collateral damage and we sit in front of these devices if you were to draw a big-picture network diagram of the site. From what I can tell so far the attack was just melting the uplinks and it took a few minutes to null-route the various attackers; when things got fixed they did so on specific routes (e.g. Layer3 to the east coast came back before another route the Dallas and the southeast, etc.)