Dropping malicious packets as close to the source as possible

Question

Rewording this unanswered question: If some malicious IP address starts flooding the internet with packets destined for my IP address, do any standard mechanisms exist to drop these packets within the internet backbone?

I envision some networking connection protocol could send a "management message" from my side of the internet backbone (to the source side of the internet backbone) saying "Previous packets were unsolicited and ignored", and ultimately cause these packets to be dropped by a router close to the source (thereby reducing traffic on all the links in between).

Conversely, where would my packets get dropped if I just started rapidly pinging (or started sending a UDP stream to) a remote unknown IP address?

Answer 1

If some malicious IP address starts flooding the internet with packets destined for my IP address, do any standard mechanisms exist to drop these packets within the internet backbone?

No. The "Internet backbone" as such doesn't exist, except for the general concept. There's no Internet police that stops 'malicious' packets, and there's no simple way to identify those packets.

some networking connection protocol could send a "management message" from my side of the internet backbone (to the source side of the internet backbone) saying "Previous packets were unsolicited and ignored"

Your router/firewall that drops those packet can send back an ICMP Destination host unreachable to the source...

and ultimately cause these packets to be dropped by a router close to the source (thereby reducing traffic on all the links in between).

... but that's not going to happen. There's simply no instance that's doing that - as there's no "central backbone" and no Internet police.

In a nutshell: if malicious traffic is going your way you need to stop that traffic at your perimeter. If the traffic is more than you can handle than you need to ask your ISP to filter it.

Answer 2

There is not a general mechanism for this that is accessible to end users. Such a mechanism would likely become a ddos vector in it's own right. Internet routing is a heavy enough process on it's own before you start adding special rules for individual customers of faraway networks.

If the amount of traffic is small you are normally just expected to deal with it. If that costs you money then so be it.

If the traffic gets to the level that your internet connection becomes unusuable and you are a valuable customer (not a broadband customer) then your ISP may offer to perform filtering on their side.

OTOH if you are a "broadband" customer there probablly isn't much you can do, except try to get a new IP address and try to stop your adversary finding it out.

If the traffic gets to the level where it becomes a problem not just for you but for your ISP then there do exist mechanisms ISPs can use to ask their peers and transit providers to drop traffic to a given destination. At the most basic they can just call or email the network operations center of their peer or transit provider and ask. With some providers it is also possible to request blackholing by advertising a BGP route with a special "community" to the provider (see for example https://www.noction.com/blog/bgp-blackhole-community )

It's important to understand though that the goal of these mechanisms is NOT to protect the service under attack, it is to protect the network as a whole. The filtering provided is very crude generally just filtering by destination address or maybe source address (though source address is of limited utility because most DOS attacks are distributed).

If a company wants to keep their service on-line despite a large DDoS then there exist commercial ddos "scrubbing" services. These services will advertise an IP block from many locations across the world, they can then perform more advanced filtering on the traffic before using some mechanism to return it to the customer.

Answer 3

In general, yes, there is a mechanism for blocking higher up the tree. But it's not something an end user will ever be able to touch. At the ISP level, there are BGP communities that can signal "null route this prefix" to peer(s). (It's been around for decades. Saves us engineers a phone call. And any typo will be mine.)

All the end user can do is call their ISP to report such an "attack". As others have pointed out, anything you could do, a hacker could also do. (that includes the phone call, but laziness mostly makes than one moot.)