North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Effective ways to deal with DDoS attacks?

  • From: LeBlanc, Jason
  • Date: Thu May 02 11:56:27 2002 
uRPF and Radware DoShield, one DoShield per link btw edge router and core
router.  Use IDS (yes there is a way to capture all your traffic and
anaylyze it, regardless of bandwidth, no it isn't one box) to identify a
signature, build a filter, config filter on DoShield, up to ~200Mb/s per
DoShield of filtering with zero impact to legit traffic.  Scale horizontally
(add more links each with a DoShield on it) based on your ingress traffic.

I've seen many suggestions on this list, this is the only thing that works
for huge (100Mb/s+) attacks.  eBay is likely the biggest target on the net,
this works for us 90% of the time.  Is the HW expensive?  Yes. (~$35k per
DoShield I think)  It works, it scales.  

There is no way a Cisco router can handle filtering attacks past a certain
point, nor is it capable of even filtering on some patterns in attack
packets.  Juniper is better, but still lacks some filtering capabilities.
Your router is a router, not a packet filter, give up trying to make it do
this until someone builds this into an ASIC on the router.

Email me off list for more info.

-----Original Message-----
From: Pete Kruckenberg [mailto:[email protected]]
Sent: Wednesday, May 01, 2002 4:18 PM
To: [email protected]
Subject: Effective ways to deal with DDoS attacks?



There's been plenty of discussion about DDoS attacks, and my
IDS system is darn good at identifying them. But what are
effective methods for large service-provider networks (ie
ones where a firewall at the front would not be possible) to
deal with DDoS attacks?

Current method of updating ACLs with the source and/or
destination are slow and error-prone and hard to maintain
(especially when the target of the attack is a site that
users would like to access).

A rather extensive survey of DDoS papers has not resulted in
much on this topic.

What processes and/or tools are large networks using to
identify and limit the impact of DDoS attacks?

Thanks.
Pete.