a highly sophisticated and persistent DDoS attack

Question

i had ddos attack

i used wireshark to analyzes packets on entery point (ethernet interface) i found packets incoming on:

mac protocol=800 (ip)
protocol=17 (udp)
src-address=(diffirent ips from the world for each packet)
src-port=(diffirent ports for each packet)
dst-address=(diffirent ips for each packet)
dst-port=(diffirent ports for each packet)

i have implemented a filter to drop all incoming traffic at my network's entry point (drop everything),
but the DDoS attack is still getting through
and i receiving UDP packets with different source and destination IP addresses for each packet,
then try to change mac address for entry interface (ethernet), and not worked ,
when you turn in interface the attack start without setup any thing.

note 1: there ars only (rx packet) without (tx packet) on entry point
note 2: my isp have (switch network) to the internet (there is no servers or routers or any thing just switches) after that the isp give us global ip (we can reatch to this ip from all internet) .

what's type this ddos ? and depens on what ?

if i have no config on entry point - no ip and nothing
only the mac-address and connection to isp
how is rx packet come without tx
i had wireshark sniff file when attacks on if needed

any help please..

network info ( and logs show nothing ) just read traffic on interface

Answer 1

i have implemented a filter to drop all incoming UDP traffic at my network's entry point, but the DDoS attack is still getting through

It's a firewall's default to drop all ingress traffic unless it a) matches an outbound session or b) is destination NATed/port forwarded to a private host.

That random traffic that you describe cannot get through your firewall unless there's something severely wrong with the setup. If you can't handle it you should hire an experienced consultant.

It's quite possible though that the amount of traffic you receive oversaturates your Internet link. In that case you'd need to ask your ISP for help, so they filter the traffic on their perimeter. There are a few methods to cope with DDoS but your ISP needs to be able to set them up. You should talk to them.