DDoS defense

A DDoS attack is about the most devastating thing that can hit your network, it serves no purpose other than to disrupt your services - by bombarding it with millions of random packets or by specifically attacking vulnerabilities in your network stack. This usually is combined with a demand for some kind of ransom. The challenge is two-fold here:

First: Realizing it is an attack. The effect of a DDoS attack usually is just "Hey! Nothing works!" So the last thing you think about is an attack. Once you realize you are being attacked it is usually over; yet the phone keeps ringing for hours afterwards because of the amount of collateral damage.

Second: Getting rid of it. Most ISPs will charge a lot of money for DDoS mitigation services or just disconnect you from their network once the attack gets too much for them to handle. Either way, the attacker wins. Unless you know how to diversify or mitigate the attack. This implies you know what is hitting you.

What is a DDoS attack?

A DDoS attack (contrary to popular belief) is not hacking. It is simply sabotage. It can be used as a smoke screen for a hacking attempt but usually it is used as a deterrent and then a ransom can be paid to be protected in the future.

The vectors for DDoS attacks are multiple, all you need is some request that you can send to a host on the Internet that will be replied to (like ping, DNS or a website) - you then forge a sender IP which happens to be the victim's IP adress. It is that simple.

image: Observium network monitoring platform

NetFlow / Monitoring

In order to defend yourself you need to see that is is an attack, first. The two most important components are NetFlow data and a good monitoring strategy.

Monitoring your ingress and egress links is crucial. Having that kind of information at hand when it hits you can provide you with a strategy. The usual monitoring products poll the device every 1-5 minutes using SNMP. This will not work during an attack.

NetFlow metadata is continuously exported from the network device itself and in case of an attack the device should even be able to take action on its own (because you won't be able to log in to it anymore)

image: Arbor Threat Mitigation System

Mitigation strategies

Getting rid of the traffic is the most important task when mitigating a DDoS attack. Most of them are simply volumetric by nature and BGP routing allows you to divert your traffic and "clean" it before re-injecting it into your network.

The easiest way to stop an attack is to block the destination at the network edge.. known as "blackholing" - this will make the attack complete but save the rest of your network. (sacrificing one customer to keep the others live) - combined with rapid DNS and IP changes this can be a viable strategy.

There are also higher-layer attacks that target specific weaknesses in firewalls and routers or operating systems that are more difficult to detect but easier to defend against. Contact us for more details and possibilities.

Be it just a netflow analyzer or a full-fledged defense strategy - we can make it happen. Contact us for details.

Page updated

Report abuse