UDP DoS mitigation?

Fri Dec 12 18:15:16 UTC 2008

We've had an increasing rate of DoS attacks that spew tens-of-thousands of
small UDP packets to a destination on our network.  We are getting roughly
2x our entire normal pps across all providers through one interface, or
about 4x normal through the individual interface.  The Cisco
7206VXR/NPE-G1 CPU melts (>95% load vs 15% average, 20% normal peak) when
this hits.

I'm using CEF and ip-route-cache flow on the outside interface.  Unicast
RPF is also enabled on the interface.  Unicast RPF in conjunction with a
BGP black-hole generator handles TCP attacks fairly well.

Two questions:
- Are there any knobs I should be turning in the Cisco config to help with
mitigate this?
- Are there any platforms that deal with high PPS/small packet more
gracefully?

We are looking at a network refresh and aren't locked into Cisco as a
vendor (although our current IP network consists entirely of Cisco gear). 
Our current aggregate (all providers, in- plus out-bound) bandwidth is
~500Mbs, but projected growth is 1Gbs within the year.

Thanks,
Rick