Stop Memcrashed amplification DDoS attack

Question

DDoS is essential part of my life so i am back with more question, Yes we started getting memcache based UDP amplification attacks, all source ports are 11211 coming from many random source IPs, we have noticed UDP packet-size is ~1400 MTU, we are using UDP application on server but that use around ~200 packet size.

We have 80Gbps pipe and soon it will be 160Gbps from my ISP, we are getting around ~10G size of memcrashed DDoS, that means my ISP link isn't getting saturated by 10G but my server has 10G getting saturated by 10G ( don't ask me why don't increase bandwidth of server which is multi-million project )

We have Cisco Nexus 9396PQ L3 switch where ISP (80Gbps) link terminated, as i mentioned earlier attack packet-size is 1400 and my application only use max ~200 packet size because of streaming nature.

Can i use ACL to filter any packet coming from port 11211 has 1400 packet-length deny? Does cisco support that?

What other option i have except buying thriparty solution or Flowspec which is not possible at this point?

EDIT: 1

Does this rule will fix my issue?

N9k(config-acl)# deny udp any eq 11211 any packet-length gt 1399

Answer 1

deny udp any eq 11211 any packet-length gt 1399 will filter the current attack.

However, attackers can easily change the attack pattern when they notice that it doesn't work any more. Additionally, blocking by source port may produce false positives = filtered client accesses. Likewise, filtering by size may also prove useless or produce undesired outcomes.

You should not expose memcached to the general Internet. Simply require your clients to register either their static public IP address (for instance in a web portal or by a simple, authenticated API - a simple URL call even) or use a VPN service you provide. This adds an authentication layer to the service and makes it impossible to abuse by anonymous hosts without much fuzz.

[edit] I was under the impression this was about running memcached-based services yourself. Apparently I got that wrong - of course you're fine with filtering by source port.

Answer 2

Finally my settle down with following Rules and it successfully helping us stopping DDoS.

1 deny udp any eq 11211 any

You can see in graph we are getting close to ~10Gbps DDoS attack but none able to hurt my services :)