5

Rewording this unanswered question: If some malicious IP address starts flooding the internet with packets destined for my IP address, do any standard mechanisms exist to drop these packets within the internet backbone?

I envision some networking connection protocol could send a "management message" from my side of the internet backbone (to the source side of the internet backbone) saying "Previous packets were unsolicited and ignored", and ultimately cause these packets to be dropped by a router close to the source (thereby reducing traffic on all the links in between).

Conversely, where would my packets get dropped if I just started rapidly pinging (or started sending a UDP stream to) a remote unknown IP address?

1
  • For every residential ISP I've ever had, cycling power on the modem caused an IP refresh. If this is an "active" problem, just get a new IP address. If that fails you may be able to call your ISP and ask for a new one.
    – MikeH
    Apr 25 at 16:49

3 Answers 3

10

If some malicious IP address starts flooding the internet with packets destined for my IP address, do any standard mechanisms exist to drop these packets within the internet backbone?

No. The "Internet backbone" as such doesn't exist, except for the general concept. There's no Internet police that stops 'malicious' packets, and there's no simple way to identify those packets.

some networking connection protocol could send a "management message" from my side of the internet backbone (to the source side of the internet backbone) saying "Previous packets were unsolicited and ignored"

Your router/firewall that drops those packet can send back an ICMP Destination host unreachable to the source...

and ultimately cause these packets to be dropped by a router close to the source (thereby reducing traffic on all the links in between).

... but that's not going to happen. There's simply no instance that's doing that - as there's no "central backbone" and no Internet police.

In a nutshell: if malicious traffic is going your way you need to stop that traffic at your perimeter. If the traffic is more than you can handle than you need to ask your ISP to filter it.

12
  • 1
    @bobuhito Only moderators have access to that information - and we don't usually look that up. :-)
    – Zac67
    Apr 25 at 11:03
  • 1
    @bobuhito http vs https has nothing to do with flooding. Note that I could in principle just pick a random IP address and flood it and it might be yours by chance. Not telling people your IP address to people who might want to flood you prevents them from flooding you, but it doesn't prevent flooding altogether. I don't see what https has to do with it.
    – user253751
    Apr 25 at 13:39
  • 3
    @bobuhito that makes no sense. anyone can make an https website. Would you download a file from a site called https://www.getfreeviruseshere.com ?
    – user253751
    Apr 25 at 15:01
  • 2
    @bobuhito That an HTTPS server is more trustworthy is thinking from 10+ years ago. There's absolutely no difference today.
    – Zac67
    Apr 25 at 17:20
  • 1
    @bobuhito I think you misunderstand what https does. It protects the data from being read by a 3rd party between your computer and the intended server. But not the IP addresses, that part is available anyway. See luxsci.com/blog/what-is-really-protected-by-ssl-and-tls.html for more information. On the server the data is decrypted, otherwise it would be impossible for it to act on that data. If the server that receives the data want to do bad things with it that's possible, https doesn't prevent that in any way.
    – Polygorial
    Apr 26 at 6:38
6

There is not a general mechanism for this that is accessible to end users. Such a mechanism would likely become a ddos vector in it's own right. Internet routing is a heavy enough process on it's own before you start adding special rules for individual customers of faraway networks.

If the amount of traffic is small you are normally just expected to deal with it. If that costs you money then so be it.

If the traffic gets to the level that your internet connection becomes unusuable and you are a valuable customer (not a broadband customer) then your ISP may offer to perform filtering on their side.

OTOH if you are a "broadband" customer there probablly isn't much you can do, except try to get a new IP address and try to stop your adversary finding it out.

If the traffic gets to the level where it becomes a problem not just for you but for your ISP then there do exist mechanisms ISPs can use to ask their peers and transit providers to drop traffic to a given destination. At the most basic they can just call or email the network operations center of their peer or transit provider and ask. With some providers it is also possible to request blackholing by advertising a BGP route with a special "community" to the provider (see for example https://www.noction.com/blog/bgp-blackhole-community )

It's important to understand though that the goal of these mechanisms is NOT to protect the service under attack, it is to protect the network as a whole. The filtering provided is very crude generally just filtering by destination address or maybe source address (though source address is of limited utility because most DOS attacks are distributed).

If a company wants to keep their service on-line despite a large DDoS then there exist commercial ddos "scrubbing" services. These services will advertise an IP block from many locations across the world, they can then perform more advanced filtering on the traffic before using some mechanism to return it to the customer.

3
  • 2
    Cloudflare (the biggest one) famously has an "I'm under attack!" button on its homepage, for people who suddenly find themselves wanting to become Cloudflare customers during an attack :)
    – user253751
    Apr 25 at 13:45
  • 2
    Read up on how CF works. That generally won't work for home or "SOHO" users. Once the address of your link is known, there's no way to stop the flood to that address. If you have a /24, it can be routed to CF, but you'd need a different address/block to talk to CF.
    – Ricky
    Apr 25 at 14:57
  • 1
    Yeah, if you are on a broadband connection your only real option is to hope you can force another IP address somehow (with some providers just rebooting your gateway is enough, with others switching MAC addresses may do it) and then keep that IP secret. Customers who actually mean something to their ISP may have more options. Apr 25 at 15:13
4

In general, yes, there is a mechanism for blocking higher up the tree. But it's not something an end user will ever be able to touch. At the ISP level, there are BGP communities that can signal "null route this prefix" to peer(s). (It's been around for decades. Saves us engineers a phone call. And any typo will be mine.)

All the end user can do is call their ISP to report such an "attack". As others have pointed out, anything you could do, a hacker could also do. (that includes the phone call, but laziness mostly makes than one moot.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.