4 ms·

Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part

Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part I don't understand how to deal with.

timdorr 13y ago
Usually there is some pattern to the traffic that can be identified and filtered out. There are manual ways to do this (iptables, basic firewalls) or more sophisticated "anti-DDOS" boxes you can buy to automate or simplify the process (e.g. Cisco Anomaly Guard or Juniper Junos DDoS Secure).
pktgen 13y ago
We don't know anything about the attack, but in general: 1. All of this requires that you have more bandwidth than the attacker. 2. ACL drop everything but the ports/protocols you use on your frontend IP. For github.com that would be TCP 80 and 443. (ACLs are cheap, can be done at wire-rate on any capable edge router, so they're a good "first step." In this case it would have the bonus of dropping DNS amplification attacks which are increasingly common.) 3. If it's a TCP SYN flood (probably from spoofed IPs) enable SYN cookies. (Of course now the bottleneck is their load balancer.) 4. If it's an L7 attack, they'll need to identify patterns in the requests to identify and drop the traffic. For example, the attacker may be requesting a single URL only. If it's an L7 attack on a TCP service, they can also automatically add a drop rule for that source address, because at this point the client IP will have been validated (via the SYN challenge). They may also be able to identify certain patterns in the traffic that can be ACL'd at the edge. For example, IP TTL being identical.
lsh123 13y ago
There are services that specialize in handling DDOS attacks with distributed data centers and large pipes. It is very hard to do it on a shared infrastructure (e.g. AWS) w/o affecting other customers thus hosting providers will be more interested in protecting other clients.
300bps 13y ago
Can someone with experience mitigating an attack like this describe how it's done? I believe Step 1 is to submit the fact that GitHub is being DDoS'd to Hacker News, reddit, Slashdot and other social networking sites with a direct link to GitHub's web site. This will cause a flood of real people to load the web site, thereby crowding out the DDoS. The site will still be down, but at least it will be due to real people and not the DDoS.

Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part I don't understand how to deal with.

timdorr 13y ago

Usually there is some pattern to the traffic that can be identified and filtered out. There are manual ways to do this (iptables, basic firewalls) or more sophisticated "anti-DDOS" boxes you can buy to automate or simplify the process (e.g. Cisco Anomaly Guard or Juniper Junos DDoS Secure).

pktgen 13y ago

We don't know anything about the attack, but in general: 1. All of this requires that you have more bandwidth than the attacker. 2. ACL drop everything but the ports/protocols you use on your frontend IP. For github.com that would be TCP 80 and 443. (ACLs are cheap, can be done at wire-rate on any capable edge router, so they're a good "first step." In this case it would have the bonus of dropping DNS amplification attacks which are increasingly common.) 3. If it's a TCP SYN flood (probably from spoofed IPs) enable SYN cookies. (Of course now the bottleneck is their load balancer.) 4. If it's an L7 attack, they'll need to identify patterns in the requests to identify and drop the traffic. For example, the attacker may be requesting a single URL only. If it's an L7 attack on a TCP service, they can also automatically add a drop rule for that source address, because at this point the client IP will have been validated (via the SYN challenge). They may also be able to identify certain patterns in the traffic that can be ACL'd at the edge. For example, IP TTL being identical.

lsh123 13y ago

There are services that specialize in handling DDOS attacks with distributed data centers and large pipes. It is very hard to do it on a shared infrastructure (e.g. AWS) w/o affecting other customers thus hosting providers will be more interested in protecting other clients.

300bps 13y ago

Can someone with experience mitigating an attack like this describe how it's done? I believe Step 1 is to submit the fact that GitHub is being DDoS'd to Hacker News, reddit, Slashdot and other social networking sites with a direct link to GitHub's web site. This will cause a flood of real people to load the web site, thereby crowding out the DDoS. The site will still be down, but at least it will be due to real people and not the DDoS.