There’s also this aspect:
So maybe it’s just cheap consumer routers, like mine, for instance, that cause this, because they botch PMTUD. Or, as is my suspicion, Canonical is simply null routing everything with an MTU >1320, in the assumption that botnets aren’t powered by mobile devices, possibly in a dynamic fashion based on congestion thresholds, which could explain the intermittence.
We have to assume that the DDoS attack is still ongoing, since there hasn’t been an official status update on it.