2

We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe.

So, to prevent DDoS we have null routed the destination (target IP) and it mitigated the attack; but, it was big service outage when you do destination D/RTBH.

We talked to ISP to support S/RTBH so we can block source (attacker) IP address instead of destination but ISP reply was they doesn't support S/RTBH. Just wondering why?

For example, if I block any source in S/RTBH and that source null route will push out to BGP routing table but does that mean from that source will block for other customers to whoever is on that ISP? I thought it should be like if destination X and source is Y then block but if only source is specified then it will be blocked for all other customer who are on that ISP.

Is that true?

3
  • To answer why, you'll have to ask your ISP. Just guessing, perhaps they don't have enough customers asking to be worth setting it up. Here's a good explanation of it: packetlife.net/blog/2010/aug/23/source-based-rtbh
    – Ron Trunk
    Commented Jan 17, 2017 at 16:35
  • @RonTrunk, as noted in the article, it is also doing D/RTBH, and I don't think that is what is wanted.
    – Ron Maupin
    Commented Jan 17, 2017 at 16:46
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Commented Aug 6, 2017 at 22:50

1 Answer 1

1

Your ISP is likely just blackholing prefixes in BGP. Routing protocols don't look at the source address of traffic. It is a pretty simple matter to route traffic with a certain destination to the null0 interface, but it is much more complicated to do policy routing based on the source address, and it takes considerable router resources, and the ISP router(s) to which you are connected may be used for multiple customers, affecting them, even if they are not needing traffic from any of those addresses by simply slowing the router(s) to a crawl. Add to that the fact that a DDoS is using many sources, and the sources are subject to change without notice, and the ISP has decided that offering S/RTBH is simply not worth it.

4
  • We have ASR1k so should we look into flowspec? but again it should need support from ISP too. if you get DDoS for just 1 min duration or short DDoS how to mitigate it?
    – Satish
    Commented Jan 17, 2017 at 16:42
  • Your ISP may not even have a router that supports FlowSpec. The ASR 1K can only support the client role. If the DDoS is over by the time you notice it, then there isn't much to be done about it. My company is huge and has something set up with a different, Tier 1 ISP to monitor and mitigate DDoS attacks. It is complex (expensive) for the ISPs, but we are large enough to make it worthwhile. I don't have all the details.
    – Ron Maupin
    Commented Jan 17, 2017 at 16:54
  • To echo the above - using flowspec or similar to black-hole traffic on your router alone isn't going to accomplish much, as the traffic is still making its way over your ISP connection to be dropped locally. The DDoS problem has to be solved at the ISP level and, unfortunately, anything that requires dynamic filtering based on destination and source is going to require a lot of state to be maintained across a lot of gear as well as capabilities for arbitrarily sized ACL's. This means lots of $$$$ to the ISP (opex and capex) that can't necessarily be recouped in customer revenue.
    – rnxrx
    Commented Jan 17, 2017 at 18:59
  • We already have D/RTBH running and we are doing null routing for destination IP but that will cause major outage. we need S/RTBH to block bad people and allow good in. flowspec has that capability which can do that just like normal ACL which can also block traffic base on protocol, src, dst and many other attributes. I think these day best solution is flowspec so far, our ISP working on it and soon it will be available for customer but its under testing right now.
    – Satish
    Commented Jan 18, 2017 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.