We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe.

So, to prevent DDoS we have null routed the destination (target IP) and it mitigated the attack; but, it was big service outage when you do destination D/RTBH.

We talked to ISP to support S/RTBH so we can block source (attacker) IP address instead of destination but ISP reply was they doesn't support S/RTBH. Just wondering why?

For example, if I block any source in S/RTBH and that source null route will push out to BGP routing table but does that mean from that source will block for other customers to whoever is on that ISP? I thought it should be like if destination X and source is Y then block but if only source is specified then it will be blocked for all other customer who are on that ISP.

Is that true?

  • To answer why, you'll have to ask your ISP. Just guessing, perhaps they don't have enough customers asking to be worth setting it up. Here's a good explanation of it: packetlife.net/blog/2010/aug/23/source-based-rtbh – Ron Trunk Jan 17 '17 at 16:35
  • @RonTrunk, as noted in the article, it is also doing D/RTBH, and I don't think that is what is wanted. – Ron Maupin Jan 17 '17 at 16:46
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it. – Ron Maupin Aug 6 '17 at 22:50

Your ISP is likely just blackholing prefixes in BGP. Routing protocols don't look at the source address of traffic. It is a pretty simple matter to route traffic with a certain destination to the null0 interface, but it is much more complicated to do policy routing based on the source address, and it takes considerable router resources, and the ISP router(s) to which you are connected may be used for multiple customers, affecting them, even if they are not needing traffic from any of those addresses by simply slowing the router(s) to a crawl. Add to that the fact that a DDoS is using many sources, and the sources are subject to change without notice, and the ISP has decided that offering S/RTBH is simply not worth it.

  • We have ASR1k so should we look into flowspec? but again it should need support from ISP too. if you get DDoS for just 1 min duration or short DDoS how to mitigate it? – Satish Jan 17 '17 at 16:42
  • Your ISP may not even have a router that supports FlowSpec. The ASR 1K can only support the client role. If the DDoS is over by the time you notice it, then there isn't much to be done about it. My company is huge and has something set up with a different, Tier 1 ISP to monitor and mitigate DDoS attacks. It is complex (expensive) for the ISPs, but we are large enough to make it worthwhile. I don't have all the details. – Ron Maupin Jan 17 '17 at 16:54
  • To echo the above - using flowspec or similar to black-hole traffic on your router alone isn't going to accomplish much, as the traffic is still making its way over your ISP connection to be dropped locally. The DDoS problem has to be solved at the ISP level and, unfortunately, anything that requires dynamic filtering based on destination and source is going to require a lot of state to be maintained across a lot of gear as well as capabilities for arbitrarily sized ACL's. This means lots of $$$$ to the ISP (opex and capex) that can't necessarily be recouped in customer revenue. – rnxrx Jan 17 '17 at 18:59
  • We already have D/RTBH running and we are doing null routing for destination IP but that will cause major outage. we need S/RTBH to block bad people and allow good in. flowspec has that capability which can do that just like normal ACL which can also block traffic base on protocol, src, dst and many other attributes. I think these day best solution is flowspec so far, our ISP working on it and soon it will be available for customer but its under testing right now. – Satish Jan 18 '17 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.