Surviving DDoS. SANOG X 5 September ed.lewis@neustar.biz. 5 Sep '07, SANOG X ed.lewis@neustar.biz 1

Size: px

Start display at page:

Download "Surviving DDoS. SANOG X 5 September 2007. ed.lewis@neustar.biz. 5 Sep '07, SANOG X ed.lewis@neustar.biz 1"

Drusilla Black
8 years ago
Views:

1 Surviving DDoS SANOG X 5 September 2007 ed.lewis@neustar.biz 5 Sep '07, SANOG X ed.lewis@neustar.biz 1

2 Theme How does a provider of information and services overcome Denial of Service situations? An important tradeoff to think about A simple constrained system is easy to control and make efficient A sufficiently capable and reliable system is going to have some complexities 5 Sep '07, SANOG X ed.lewis@neustar.biz 2

An important tradeoff to think about A simple constrained system is easy to

3 Agenda Know Your Enemy Defensive Strategy Anycast as a Building Block Effective Defense 5 Sep '07, SANOG X ed.lewis@neustar.biz 3

4 Know Your Enemy Denial of Service attack on a process DoS attack on a computer Dos attack on a network DDoS attack 5 Sep '07, SANOG X ed.lewis@neustar.biz 4

5 What is a DoS? DDos? Slowing a process Killing a process bad packets good packets Crunch Service Element (Process) Service Element (Process) 5 Sep '07, SANOG X ed.lewis@neustar.biz 5

6 Network Level DoS A Network Denial of Service ISP Router Customer Router Service Element (Process) The attack hits in the ISP, not the "victim" site. DDoS - traffic floods from different ISPs 5 Sep '07, SANOG X ed.lewis@neustar.biz 6

7 Network Level DDoS Different ISP Attack traffic mingles with legitimate cross border traffic ISP Router Customer Router Service Element (Process) Different ISP Different ISP 5 Sep '07, SANOG X ed.lewis@neustar.biz 7

Router Customer Router Service Element (Process)

8 Defensive Strategy Toss the bad packets faster than they arrive Identify the bad ones time-to-identify Dispose of them as quickly as possible time-to-dispose Give yourself more time to act time-between-arrivals 5 Sep '07, SANOG X ed.lewis@neustar.biz 8

as quickly as possible time-to-dispose Give yourself more time

9 Applying some math Queuing Theory "average service time must be less than the inter-arrival rate or the system is unstable" If queues always grow longer, it is bad If (time-to-identify + time-to-dispose) > (time-between-arrivals) then you have a problem 5 Sep '07, SANOG X ed.lewis@neustar.biz 9

longer, it is bad If (time-to-identify + time-to-dispose) >

10 Time diagram t i m e client server server Transmission time Identify Dispose Time spent on attack packet Identify Dispose 5 Sep '07, SANOG X ed.lewis@neustar.biz 10

11 Time diagram - "red" t i m e client server server Transmission time Identify Dispose Time spent on attack packet Identify Dispose Bad interarrival time What a jumbled mess! 5 Sep '07, SANOG X ed.lewis@neustar.biz 11

attack packet Identify Dispose Bad interarrival time

12 Time diagram - "green" t i m e client server server Transmission time Identify Dispose Time spent on attack packet Identify Dispose Good interarrival time Time to "breathe" between packets is good 5 Sep '07, SANOG X ed.lewis@neustar.biz 12

packet Identify Dispose Good interarrival time Time to

13 Time diagram t i m e client server server Transmission time Identify Dispose Time spent on attack packet Identify Dispose Bad interarrival time If the next packet is the red one, trouble, if it is green, you are okay. Good interarrival time 5 Sep '07, SANOG X ed.lewis@neustar.biz 13

time If the next packet is the red one, trouble, if it is green, you

14 What do we do? Time to identify Look for the attack's pattern Time to dispose Filter, drop fast Inter-arrival time More service points (e.g., load balancing) 5 Sep '07, SANOG X ed.lewis@neustar.biz 14

15 Looking at "Service Points" More than just "add capacity" Attacks can scale more cheaply than defenses Well placed capacity needed Important building block: Anycast 5 Sep '07, SANOG X ed.lewis@neustar.biz 15

16 Anycast Anycast basics Why it works When does it break? 5 Sep '07, SANOG X ed.lewis@neustar.biz 16

17 Single-Multihomed-Anycast Single Homed A Multi-homed A A A Anycast 5 Sep '07, SANOG X ed.lewis@neustar.biz 17

18 Anycast More instances, serving network localities Coordinated, best if servers are "stateless" DNS is ideal ecommerce not so ideal 5 Sep '07, SANOG X ed.lewis@neustar.biz 18

19 With/Without Anycast Showing request flows One unicast service point Three anycast service points A A A A Traffic increasingly isolated one ISP 5 Sep '07, SANOG X ed.lewis@neustar.biz 19

20 Anycast Tradeoffs Saves Addresses Divide and Conquer strategy to handle large audiences One large network looks like many simple Many points - higher costs of operation Must coordinate routing and application load balancing strategies 5 Sep '07, SANOG X ed.lewis@neustar.biz 20

points - higher costs of operation Must coordinate routing and

21 Routing Magic Anycast is about routing "magic" Lets routing system determine the set of clients (the "audience") for a server To make this reliable, the routing determination must be "controlled." Otherwise, instability and unpredictability take over 5 Sep '07, SANOG X ed.lewis@neustar.biz 21

22 Effective Defense Excess Provisioning Pre-positioning Anycast is a tool of each, but more work is still needed by each defensive strategy 5 Sep '07, SANOG X ed.lewis@neustar.biz 22

23 Excess Provisioning One approach is to have more capacity than any attack Resources that can be put into service only when needed (to cut cost of always "up") Relationships to get help from the different ISPs through which all attack traffic flows. 5 Sep '07, SANOG X ed.lewis@neustar.biz 23

24 Normal and Reserve Capacity Your normal capacity Up/down Stream "Your" ISP A Filter set up via special relationships A Your reserve capacity 5 Sep '07, SANOG X ed.lewis@neustar.biz 24

25 Limits Available "excess" capacity There's a cost when unutilized Scale of (human) relationships Requesting filters is not automated Have to maintain global relations with ISPs 5 Sep '07, SANOG X ed.lewis@neustar.biz 25

26 Pre-positioning Two part strategy Put data where it needs to be ahead of time Good strategy for something like DNS Use routing to control where data is accessed Try to minimize traffic between ISPs 5 Sep '07, SANOG X ed.lewis@neustar.biz 26

27 C u s t o m e r s Routing Techniques C u s t o m e r s C u s t o m e r s ISP recursive DNS DNS C u s t o m e r s C u s t o m e r s No route (normal) Backup path when internal server fails Attack traffic from here never goes to ISP Exchange Point 5 Sep '07, SANOG X ed.lewis@neustar.biz 27 D N S

28 Advantages of Pre-positioning Puts more control in hands of ISP If attack traffic happens, it comes from within ISP, source is apparent Makes network performance more stable Better access in "non-attack" times Closer servers mean faster roundtrips 5 Sep '07, SANOG X ed.lewis@neustar.biz 28

29 Conclusion DDoS attacks are part of the Internet Defense can't count on scaling past size of attack Data servers in ISP benefits service provider, ISP, and customers And simplifies the network Needs ISP to trust service provider! 5 Sep '07, SANOG X ed.lewis@neustar.biz 29

30 The last slide Discussion? 5 Sep '07, SANOG X ed.lewis@neustar.biz 30

DDoS Protection. How Cisco IT Protects Against Distributed Denial of Service Attacks. A Cisco on Cisco Case Study: Inside Cisco IT

DDoS Protection. How Cisco IT Protects Against Distributed Denial of Service Attacks. A Cisco on Cisco Case Study: Inside Cisco IT DDoS Protection How Cisco IT Protects Against Distributed Denial of Service Attacks A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge: Prevent low-bandwidth DDoS attacks coming from a broad