Effective ways to deal with DDoS attacks?

Sun May 5 07:44:10 UTC 2002

On Sun, 5 May 2002, Christopher L. Morrow wrote:

> > > like with single homed customers. The only time when those sets of
> > > prefixes is NOT the same is for a backup connection. But if a connection

> > Not always the case, customer behaviour can not be accurately modeled.

> I was hoping someone else might mention this, BUT what about the case of
> customers providing transit for outbound but not inbound traffic for their
> customers? We have many, many cases of customers that are 'default
> routing' for their customers that get inbound traffic down alternate
> customers or peers or wherever...

Is there a compelling reason you should allow this? If yes, you can't use
uRPF and you have to install an acl to do sanity checking on the
customer's source addresses. If no, they'll have to announce those routes
to you. If they set the no export community they still won't get any
inbound traffic to speak of.

> uRPF seems like a not so good solution
> for these instances :( especially since some of these are our worst
> abusers :(

Well if these are your worst abusers, it seems to me uRPF is exactly what
those customers need.  ;-)