I too would be interested if someone could point a good white paper for cisco DDOS protection mechanisms and best practices in general. On Thu, May 20, 2004 at 11:52:01AM -0700, Mark Kent wrote:

I've been trying to find out what the current BCP is for handling ddos attacks. Mostly what I find is material about how to be a good net.citizen (we already are), how to tune a kernel to better withstand a syn flood, router stuff you can do to protect hosts behind it, how to track the attack back to the source, how to determine the nature of the traffic, etc.

But I don't care about most of that. I care that a gazillion pps are crushing our border routers (7206/npe-g1).

Other than getting bigger routers, is it still the case that the best we can do is identify the target IP (with netflow, for example) and have upstreams blackhole it?

Thanks, -mark

--- Wayne Bouchard web@typo.org Network Dude http://www.typo.org/~web/

On Thu, May 20, 2004 at 11:52:01AM -0700, Mark Kent wrote:

I've been trying to find out what the current BCP is for handling ddos attacks. Mostly what I find is material about how to be a good net.citizen (we already are), how to tune a kernel to better withstand a syn flood, router stuff you can do to protect hosts behind it, how to track the attack back to the source, how to determine the nature of the traffic, etc.

But I don't care about most of that. I care that a gazillion pps are crushing our border routers (7206/npe-g1).

Other than getting bigger routers, is it still the case that the best we can do is identify the target IP (with netflow, for example) and have upstreams blackhole it?

or acl it. some providers offer blackhole services where you can inject a route to them via bgp over the same session (with communities) or over a different session that just takes blackhole routes.. that can be used by you to cause them to null0/discard the traffic within their network automatically.. with junipers being used commonly these days, and their ability to write long, complex firewall filters, I think you're seeing more people do fancier things.. I've placed filters for at least one customer (for the duration of a DoS) that match on specific packet sizes or packet ranges of a specific type. The more you know about the profile of the attack you have going on, the better others can help you mitigate it.. - jared -- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.

On Thursday, May 20, 2004 2:52 PM, Mark Kent wrote:

I've been trying to find out what the current BCP is for handling ddos attacks. Mostly what I find is material about how to be a good net.citizen (we already are), how to tune a kernel to better withstand a syn flood, router stuff you can do to protect hosts behind it, how to track the attack back to the source, how to determine the nature of the traffic, etc.

This depends entirely on your definition of handling. To some people this means shutting down the victim to save the network as a whole. To others this means keeping everyone running smoothly, including the victim. The latter is preferred of course, but it is not for those who aren't willing to pay for it.

But I don't care about most of that. I care that a gazillion pps are crushing our border routers (7206/npe-g1).

Other than getting bigger routers, is it still the case that the best we can do is identify the target IP (with netflow, for example) and have upstreams blackhole it?

It sounds like you're willing to blackhole the victim. In that case, yes, netflow is highly useful in finding out just who is getting attacked. Once you have that information, you can either manually contact your upstreams to have them null route the destination IP, or better yet, arrange ahead of time for a way to send properly tagged BGP announcements to them to blackhole /32s anytime you want. The alternative is to get bigger links, bigger routers, and protect the host. For bigger links and bigger routers, keep PPS in mind. Some attacks are large packets and large bandwidth, with low PPS. Other attacks are low bandwidth, but high PPS. I get hit pretty regularly with 500k-600k PPS of SYNs. While this only adds up to a few hundred megabits of traffic, that is a lot of PPS for many routers, firewalls, servers, or whatever else they might hit. Junipers, for example, have no problem with high PPS. Second, you have to figure out how to protect the host(s). We've gone with Riverhead (recently bought by Cisco) and they work quite well. I've seen attacks as high as around 650k PPS of spoofed SYNs, and the site running on a single (relatively weak) server remains up and generally unaffected by the attack.

Is there any quantification on what qualifies as a Large DDOS attack and perhaps a comparison of what type of routers can/can't handle such a load? Typical DDOS's that I've seen are 10-20X the normal incoming packet rate, upto and over 1Mpps. Having to switch that amount of additonal load has a tremendous impact on linecard CPU and any amount of additional features to try and protect your customer will sometimes result in a degradation to *everyone* not just the target. In my experience calling the upstream provider and having it blocked is still the only thing that can be done. When working on the backbone I've spent hours tracking the majority of flows back to one or more peering points and blocking it there where the attack isn't as concentrated and thus safer to filter. -Brent At 11:52 AM 5/20/2004, Mark Kent wrote:

I've been trying to find out what the current BCP is for handling ddos attacks. Mostly what I find is material about how to be a good net.citizen (we already are), how to tune a kernel to better withstand a syn flood, router stuff you can do to protect hosts behind it, how to track the attack back to the source, how to determine the nature of the traffic, etc.

But I don't care about most of that. I care that a gazillion pps are crushing our border routers (7206/npe-g1).

Other than getting bigger routers, is it still the case that the best we can do is identify the target IP (with netflow, for example) and have upstreams blackhole it?

Thanks, -mark

On May 20, 2004, at 12:52 PM, Mark Kent wrote:

I've been trying to find out what the current BCP is for handling ddos attacks. Mostly what I find is material about how to be a good net.citizen (we already are), how to tune a kernel to better withstand a syn flood, router stuff you can do to protect hosts behind it, how to track the attack back to the source, how to determine the nature of the traffic, etc.

There's lots and lots of really-useful-very-often-multi-vendor stuff here: ftp://ftp-eng.cisco.com/cons/isp/security/ In particular, under the bootcamp and CPN-summit stuff. Though it may seem vendor-specific per logos and the like, I know of several (more than three) vendors that have contributed to this content, most of which is very practical and generally informative, and should be applicable to most deployed vendors. There's also some VOD stuff here that expands some areas of the content: http://www.getitmm.com/bootcampflash/launch.html HTH, -danny