How would you protect a company's internet edge from a DDoS attack?
Show the answer
Say this first
First I classify the attack: volumetric floods, often reflection and amplification over UDP (DNS, NTP, CLDAP, memcached); state exhaustion attacks such as SYN floods aimed at firewalls and load balancers; or application-layer floods of HTTP requests. Anything bigger than my internet links must be stopped upstream, by the ISP or a cloud scrubbing service, with traffic diverted by BGP or DNS. Locally I protect state with SYN cookies and connection limits, protect the routers with CoPP, and drop reflection traffic that no service needs. As a last resort, remote triggered blackholing drops everything to the attacked address at the ISP to save the rest of the network.
Go deeper
Amplification in one paragraph
The attacker sends small requests with the victim's address as the source to open servers that send much larger replies. The victim receives the replies from thousands of legitimate servers. That is why open resolvers and exposed UDP services are a problem for everyone, not only their owners.
Upstream tools
- Scrubbing: always-on or on demand. On attack, the scrubbing provider announces your prefix (often a /24), cleans the traffic and returns it over a tunnel or direct link.
- RTBH: you tag the victim /32 to your ISP with the BLACKHOLE community 65535:666 (RFC 7999) or the ISP's own community, and the ISP drops it at its edge. The rest of your network survives; the victim address goes dark.
- BGP Flowspec (RFC 8955): pushes match and action rules, such as "drop UDP from source port 123 to 203.0.113.10", to routers that support it.
Local tools
- ACLs at the edge that drop well-known reflection source ports toward services that never need them.
- SYN cookies or SYN proxy, connection limits per source.
- CoPP so the routers keep their BGP sessions during the attack.
- CDN and anycast in front of public web services.
Do not be a source
BCP 38 (RFC 2827) ingress filtering so your customers and hosts cannot send spoofed sources, no open resolvers, no exposed amplifying services.
Runbook
Baseline traffic with NetFlow or sFlow, alert on deviations, keep ISP and scrubbing contacts and the agreed communities written down, and rehearse the diversion before you need it.
They will ask next
Why can't the firewall stop a 40 Gbps attack on a 10 Gbps link?
The link is full before packets reach the firewall. Whatever the firewall drops, legitimate traffic has already been lost upstream. Often the firewall's session table falls over first anyway.
What is BCP 38?
Ingress filtering: networks drop packets arriving from customers whose source address does not belong to that customer. Implemented with ACLs or uRPF at the customer edge. It stops spoofing at the source, which removes the fuel for reflection attacks.
Traps
- Answering "buy a bigger firewall". Volumetric attacks are solved upstream.