2

I need suggestion related this issue. We are getting DDoS every two days and its small DDoS last for 5 to 10 min. but sometime its longer in that case we call ISP and they null route specific targeted IP for sometime and we moved service to new IP.

Now question is, is it possible we setup private BGP with our ISP and we do null route from our router so it trigger blackhole null route on ISP route? In short we need control of doing null routing, calling every time ISP isn't good solution because sometime they are busy then we have to wait in line.

Can anyone suggest what we should do? We are small company and can't effort buying outside service to scrub DDoS they are expensive.

Improve this question
7

The only answer we can give you is 'talk to your ISP'. Remotely triggered blackholing (RTBH) is an often used technique, but we can't tell if your ISP supports this.

When using RTBH, you can announce to your upstream which target IP's should be blackholed, either over a dedicated BGP sessions or by tagging target prefixes with a specific community.

Improve this answer
4
  • You mean say if ISP agreed then it is possible right?? We can setup private BGP between us and ISP. I am just check all option before start talking to ISP. – Satish Feb 21 '16 at 17:24
  • 4
    You should start with talking to your ISP. They know what they can and want to do. Then you can decide on what works for you. But yes, RTBH may be the solution here, if they support it. – Teun Vink♦ Feb 21 '16 at 17:28
  • Question, If we setup BGP peering with our ISP then should i need /24 subnet to advertisement, BGP won't work with small subnet.. is that true? – Satish Mar 11 '16 at 18:48
  • Yes, a large majority of networks will not accept any prefix smaller than a /24. – Teun Vink♦ Mar 11 '16 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.