Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Growing DoS attacks

  • From: Barb Dijker
  • Date: Thu Jan 17 16:59:53 2002

At 06:51 PM 1/16/02 -0500, Jared Mauch wrote:
        Something that people may want to consider doing is
that assuming you are using hardware/software that can support
rate-limit of specific packet types/rates, you could
generate some rate-limits to limit specific types of traffic
to various ranges.
Most dDoS we see are udp floods with tiny packets, if not
all that have any noticeable effects.  In fact we haven't
seen a single one that wasn't packets <70bytes, so we monitor
average packet size as a DoS alert.

Rate limiting might work to prevent your dDoS participants
from hurting your neighbors, but maybe not even that.
1.5Mb of syn, icmp, or udp from your net and 100 others
will bring many folks down including me.  Rate limiting does
nothing to protect your own net from the outside.

For example, if I rate limit an external T3,
that does no good if the T3 is being soaked from the
other end, that T3 is effectively down.  What it takes to soak
an external T3 would be noise to the folks from whom I get the T3
(or they shouldn't be selling me a T3).  Usually, "soaked" is
with pps and the total bandwidth in use drops dramatically.
So rate limiting at so-called "tier 1" is maybe going to help
folks at tier 2 and 3, but not at tier 1, and likewise down
the line.

We can encourage customers to keep patched.
We can offer to security scan them.  We can firewall them
(we firewall all our dsl residential and most dsl biz customers).
But we can't make them completely secure and thus harmless.
We can only pull the plug once they get hacked and start


Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.