North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: engineering --> ddos and flooding

  • From: Mark Mentovai
  • Date: Fri Jun 01 14:44:48 2001 
Walter Prue wrote:
>I came up with a solution for networks with ISP connections to deal
>quickly with DDOS attacks without having to be able to work with a
>network technician at the ISP for immediate relief.  If the ISP agrees,
>install a second low speed connection to the same router your primary
>router BGP peers with.  Through this low speed connection you run a
>second bgp session advertising the /32 that is being attacked by the
>DDOS.  You mark the /32 as NO-ADVERTISE so the route doesn't leave the
>border router.

Or, without adding an extra connection, negotiate a NULLROUTE community with
your upstream provider.  This would be a wonderful addition to the
well-known BGP communities.  I'll bring this up on IDR.

Mark