Having seen / been through a few DDoS attacks, some comments:
- The main attacks have been targeting port 80, ie web sites.
- "small" attacks are 500MB/s-> 800MB/s.
- "large" attacks are multiple GB/s.
- Synfloods come from random source IPs, that are obviously forged.
- The only viable way to "stop" a DDOS attack is to have upstream providers
null-route the target IP address (also obviously cutting off access to the real
product offering as well).
- Most hardware that offers DDOS prevention only does a ok job at it. Most
hardware (Cat6500s, F5, etc) isn't really designed (usually CPU resource
problems) to handle the PPS rate that most DDoSs generate. We've tried all
sorts of options like syn proxying in hardware, but nothing has been
successful except for the TopLayer 5500s that have been mentioned on the list
(no experience w/ the 100s).
The best defense I've found to date for mitigating attacks is:
- have a public facing packet scrubber (like the TopLayers) that can understand
synflood, keep the state table for millions+ possible source IPs and have
enough CPU/network power to handle the Mb/s / PPS rates.
- You need to have more bandwidth than the attacker. This can become VERY
expensive (know how much it costs to have 5GB/s of public bandwidth?). There
are some companies that offer "cleaning" services where traffic first passes
through them, and then on to you after being cleaned (the customer never sees
your IP space, and hence can't target it). Prolexic or Akamai are a couple
examples..
Feel free to contact me off list for more information.
- Brandon
_____________________________________________________________________________________________________________________________
FXCM, L.L.C.® assumes no responsibility for errors, inaccuracies or omissions
in these materials. FXCM, L.L.C.® does not warrant the accuracy or completeness
of the information, text, graphics, links or other items contained within these
materials. FXCM, L.L.C.® shall not be liable for any special, indirect,
incidental, or consequential damages, including without limitation losses, lost
revenues, or lost profits that may result from these materials. All information
contained in this e-mail is strictly confidential and is only intended for use
by the recipient.
