Advanced Countermeasures to prevent a Ddos

Fri Jul 20 05:22:28 UTC 2001

At 16:38 19/07/01 -0400, you wrote:

It all hinges on your upstream ISPs.  The things to ask for are:

- SYN and ICMP rate limiting:  If you buy a T3 from your upstream, you 
should ask that they place on *their* peering routers and on the router 
facing you, Cisco rate limits of about 512kb/sec of ICMP and about 
128kb/sec of SYNs.  Pay extra if need be.
- anti-spoofing: require your upstream ISPs to implement full anti-spoofing 
for incoming packets.  That includes RFC1918, unassigned IANA blocks and 
(as a minimum) IP anti-spoofing on all single-homed customer links (Cisco 
ip verify unicast reverse-path)
- BGP community: Your upstream should allow you to announce a BGP community 
for any sub-prefix in your IP block (meaning he has to not be strict in the 
length of the prefix you announce to him since it can change dynamically) 
that will me ROUTENULL, which means they eat the packets for you.

Find 2 upstreams who will agree to the above 3 items and you are 99% safe 
from dDoS.

-Hank

>I was wondering if anyone on this list has considered the idea of trying to
>eliminate Ddos attacks while designing their Data Centre's network topology.
>If so, did you include server isolation and or distribution?
>
>Secondly, is it even possible to eliminate (or as close to elimination as
>one can have in the tech world) Ddos attacks with network design and server
>implementation.  Does anyone have an advanced understanding of these issues
>and if so are you willing to exchange information off-line?
>
>
>Scott E. MacKenzie
>semackenzie at crop.attcanada.ca
>