D/DoS mitigation hardware/software needed.

Stefan Fouant sfouant at shortestpathfirst.net
Tue Jan 5 05:39:46 UTC 2010


> -----Original Message-----
> From: Suresh Ramasubramanian [mailto:ops.lists at gmail.com]
> Sent: Tuesday, January 05, 2010 12:19 AM
> 
> On Tue, Jan 5, 2010 at 10:38 AM, Dobbins, Roland <rdobbins at arbor.net>
> wrote:
> >
> >> Additional mitigation would be  via manual or automatic RTBH or
> security/abuse@ involvement with upstreams.
> >
> > Automagic is generally bad, as it can be gamed.
> 
> ... and manual wont scale in ddos

There are pros and cons to each approach.  Certain types of things can be automated, in fact I've done this using the Auto-mitigate feature in Arbor coupled with pre-configured mitigation templates for certain types of traffic and it works very well.  But generally, as Roland mentioned automagic stuff can be gamed and for the majority of the stuff you are going to want an operator to look at the alert before making the decision to offramp.

The trick is to try to automate as much around the process as possible - I've worked in environments where just making little changes to incident handling response methods reduced the time to mitigate an attack from hours to minutes, all the while still requiring an operator to press the "big red button" to offramp and enable the mitigation.

Stefan Fouant, CISSP, JNCIE-M/T
www.shortestpathfirst.net
GPG Key ID: 0xB5E3803D





More information about the NANOG mailing list