This is insane how big these things are now: "There have been some reports of a magnitude in the 1.2 Tbps range; at this time we are unable to verify that claim."
They mention 100k participating devices/IPs - that would mean an average of 12 Mbps upload. Sounds high, but plausible? [ed: I actually think it's kind of sad that most users aren't on symmetric gigabit links yet... But in this context I guess it's a blessing of sorts... ]
"They mention 100k participating devices/IPs - that would mean an average of 12 Mbps upload"
I doesn't have to be. An attack can be highly asymmetric such amplification/reflection attack. I am not saying this is what happened in the Dyn case but rather addressing your average comment. Just an example having hosts in the botnet send queries to non-Dyn open resolvers on the internet and in those queries they spoof the source IPs of Dyn DNS servers. Now all of those open resolvers on internet start sending return traffic to Dyn. If in those spoof request they request EDNS0 those responses could be up to 4K. Compare that to the size of query packet and you have a lot leverage.
We already know Mirai has been able to reach over 1 Tbps, and we know Mirai was at least one of the cannons hitting Dyn. So 1.2 Tbps is definitely plausible. Mirai has decreased in size to a degree due to more public awareness, but it's still massive.
