DDoS is essential part of my life so i am back with more question, Yes we started getting
memcache based UDP amplification attacks, all source ports are
11211 coming from many random source IPs, we have noticed UDP packet-size is ~1400 MTU, we are using UDP application on server but that use around ~200 packet size.
80Gbps pipe and soon it will be
160Gbps from my ISP, we are getting around ~10G size of memcrashed DDoS, that means my ISP link isn't getting saturated by 10G but my server has 10G getting saturated by 10G ( don't ask me why don't increase bandwidth of server which is multi-million project )
Cisco Nexus 9396PQ L3 switch where ISP (80Gbps) link terminated, as i mentioned earlier attack packet-size is 1400 and my application only use max ~200 packet size because of streaming nature.
Can i use ACL to filter any packet coming from port 11211 has 1400 packet-length deny? Does cisco support that?
What other option i have except buying thriparty solution or Flowspec which is not possible at this point?
Does this rule will fix my issue?
N9k(config-acl)# deny udp any eq 11211 any packet-length gt 1399