DDOS solution recommendation

[Roland Dobbins]

On 11 Jan 2015, at 20:52, Ca By wrote:

> 1. BCP38 protects your neighbor, do it.

It's to protect yourself, as well.  You should do it all the way down to 
the transit customer aggregation edge, all the way down to the IDC 
access layer, etc.

> 2.  Protect yourself by having your upstream police Police UDP to some
> baseline you are comfortable with.

This will come back to haunt you, when the programmatically-generated 
attack traffic 'crowds out' the legitimate traffic and everything 
breaks.

You can only really do this for ntp.

> 3.  Have RTBH ready for some special case.

S/RTBH and/or flowspec are better (S/RTBH does D/RTBH, too).

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>