We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe.
So, to prevent DDoS we have null routed the destination (target IP) and it mitigated the attack; but, it was big service outage when you do destination
We talked to ISP to support
S/RTBH so we can block source (attacker) IP address instead of destination but ISP reply was they doesn't support
S/RTBH. Just wondering why?
For example, if I block any source in
S/RTBH and that source null route will push out to BGP routing table but does that mean from that source will block for other customers to whoever is on that ISP? I thought it should be like if destination X and source is Y then block but if only source is specified then it will be blocked for all other customer who are on that ISP.
Is that true?