Traffic Diversion Techniques for DDoS Mitigation using BGP Flowspec. Leonardo Serodio May 2013
|
|
- Edgar Bishop
- 8 years ago
- Views:
Transcription
1 Traffic Diversion Techniques for DDoS Mitigation using BGP Flowspec Leonardo Serodio May 2013
2 Distributed Denial of Service (DDoS) Attacks DDoS attack traffic consumes SP network capacity DDoS attack traffic saturates inline security devices Bots Victim Firewall IPS Internet Service Provider Network Enterprise or IDC DDoS attacks launched from compromised systems (bots) DDoS attack traffic targets applications & services 2
3 Cloud-based DDoS Defense with RTBH BGP Announcement Originated by the Victim D/RTBH - All traffic to the victim is discarded! Remotely Trigered Black Hole Filtering at Peer SP edge Victim initiates BGP announcement Victim RTBH RTBH Firewall IPS Good traffic Attack traffic Internet BGP Announcement Service Provider Network Enterprise or IDC BGP Prefix with next-hop set to predefined black-hole route. Fourth most used tool to mitigate DDoS attacks [5] RFCs: RFC 3882, RFC 5635 (includes D/RTBH and S/RTBH) 3
4 Cloud-based DDoS Defense with RTBH BGP Announcement Originated by the SP D/RTBH - All traffic to the victim is discarded! Remotely Trigered Black Hole Filtering at SP edge Victim RTBH RTBH Firewall IPS Internet Good traffic Attack traffic BGP Announcement Service Provider Network Enterprise or IDC BGP Prefix with next-hop set to predefined black-hole route. 4
5 BGP Flow Specification BGP Flowspec defines a new BGP Network Layer Reachability Information (NLRI) format used to distribute traffic flow specification rules. NLRI (AFI=1, SAFI=133): IPv4 unicast filtering NLRI (AFI=1, SAFI=134): BGP/MPLS VPN filtering Specified by RFC 5575 [1], extended to IPv6 in [2] Main application today is to automate the distribution of traffic filter lists to routers for the mitigation of DDoS attacks. Selectively drop traffic flows based on L3/L4 information. Intelligent control platform builds filter rules to drop harmful traffic, encodes them as BGP flowspec routes and advertises them to BGP peers. 5
6 BGP Flow Specification The Flow specification can match on the following criteria: Source / Destination Prefix IP Protocol (UDP, TCP, ICMP, etc.) Source and/or Destination Port ICMP Type and Code TCP Flags Packet Length DSCP (Diffserv Code Point) Fragment (DF, IsF, FF, LF) Actions defined using Extended Communities: 0x8006: traffic-rate (rate 0 discards all traffic for the flow) 0x8007: traffic-action (sample) 0x8008: redirect to VRF 0x8009: traffic-marking (DSCP value ) 6
7 BGP Flow Specification Why Use It for ACLs? ACLs are still the single most widely used tool to mitigate DDoS attacks [5]. But ACLs are demanding in configuration & maintenance. BGP Flowspec leverages the BGP Control Plane to simplify the distribution of ACLs, greatly improving operations: Inject new filter rules to all routers simultaneously without changing router configuration. Reuse existing BGP operational knowledge and best practices. Control policy propagation via BGP Communities. Improve response time to mitigate DDoS attacks. Route validation performed for ebgp sessions, see draft [3] for revised validation procedure for ibgp sessions. 7
8 Cloud-based DDoS Defense with BGP Flowspec Inter-domain flowspec injection Volumetric attack traffic removed at ISP network edge Only clean traffic delivered to enterprise/idc Flowspec Victim Flowspec Flowspec Firewall IPS Internet Service Provider Network Enterprise or IDC Good traffic Attack traffic Flowspec Flowspec mitigation controlled by ISP customer under attack 8
9 Cloud-based DDoS Defense with BGP Flowspec Intra-domain flowspec injection Volumetric attack traffic removed at ISP network edge Only clean traffic delivered to enterprise/idc Flowspec Victim Flowspec Flowspec Internet SOC Service Provider Network Firewall IPS Enterprise or IDC Good traffic Attack traffic Flowspec Flowspec mitigation controlled by the ISP or ISP customer via Portal 9
10 BGP Flow Specification Vendors & Users Router vendors supporting BGP Flowspec: Alcatel-Lucent 7750 SROS 9.0R1 Juniper JunOS 7.3 DDoS mitigation vendors: Arbor Peakflow SP 3.5 BGP Tools: ExaBGP Injector [7] Users: North America: TW Telecom (TWTC) [6], other Tier 1, Tier 2 Europe: Tier 1, Tier 2 Latin America & Caribbean: RNP (Brasil) [8] Flowspec itself is the 8 th most used tool to mitigate attacks [5] 10
11 DDoS attacks: Increasing Scale & Sophistication DDoS Attack Bandwidth (Gbps) Volumetric Attacks Network Infrastructure Application Attacks IDCs & Services Source: Arbor Networks 2012 Worldwide Infrastructure Security Report, Volume VIII 11
12 DDoS Protection with Mitigation Appliance (IDMS) Surgical Mitigation Traffic anomaly is scrubbed by a DPI-capable mitigation appliance that surgically removes the attack traffic only. Mitigation appliances are also known as Intelligent DDoS Mitigation Systems (IDMS). IDMS are the second most used tool for DDoS protection [5]. Able to mitigate complex, application-layer DDoS attacks without completing the attack. Typically a shared resource in the network infrastructure. Traffic anomalies need to be redirected in the network to go through the IDMS before reaching the intended destination: - Traffic Diversion or Offramping - Traffic Reinjection or Onramping 12
13 IDMS-based DDoS Mitigation Terminology Diversion or Offramping: rerouting of traffic destined to the victim to the DDoS mitigation appliance for scrubbing. Reinjection or Onramping: redirection of scrubbed (clean) traffic back to its intended destination. Typically, traffic diversion takes place through more specific BGP prefix announcements (victim addresses), usually in the GRT (called diversion/offramp route): Easier to control & manipulate routes (NH, Communities) Can be signaled across AS boundaries if required Traffic Reinjection usually requires tunneling or an alternate routing domain (VRF) to get clean traffic back to its intended destination without looping. 13
14 IDMS-based DDoS Mitigation Scrubbing Center Design Traffic Diversion Scrubbing Center IDMS (Mitigation Appliance) Scrubbed Traffic Reinjection Internet Victim Firewall IPS Good traffic Attack traffic BGP Prefix Diversion Diversion Prefixes (BGP) Detection & Control Internet GRE Tunnel or VRF (dotted yellow line) Enterprise or IDC 14
15 IDMS-based DDoS Mitigation Distributed Design Embedded IDMS Internal Traffic Diversion & Scrubbing Scrubbing Center IDMS (Mitigation Appliance) Internet Victim I M D S Firewall IPS Embedded IMDS I M D S Detection & Control Enterprise or IDC Good traffic Attack traffic BGP Prefix Diversion Internet 15
16 Traffic Diversion with BGP Prefixes The Good & The Bad Real mitigation of DNS attack 16
17 DDoS Mitigation Appliance Surgical Diversion Using BGP Flowspec Redirect to VRF Action Traffic diversion using a VRF (subset of all traffic to victim). Scrubbing Center Mitigation Appliance Traffic Reinjection Internet Victim Firewall IPS BGP Flowspec filter to redirect only specified traffic Detection & Control Enterprise or IDC Dirty VRF Good traffic Attack traffic BGP Flowspec Diversion Internet 17
18 Surgical Diversion Using BGP Flowspec Optimized Design & Operation No changes to the Global Routing Table (GRT) Diversion performed by Flowspec NLRI Flowspec filter Action configured to Redirect to VRF Extended Community 0x8008. Less intrusive to the routing system No need for a tunneling design for reinjection/onramping Clean traffic can simply be sent back to the GRT More granular control of diverted traffic Allows for the redirection of only a subset of the traffic to the victim: specific protocols, ports, source prefix, destination prefix Less traffic overhead for Mitigation Appliance to deal with 18
19 Surgical Diversion Using BGP Flowspec Enabling New Workflows Facilitates the implementation of new mitigation workflows for demanding use cases: Always on Mitigations for critical resources: HTTPS traffic only (normal web traffic follows on-demand mitigation model) ICMP & UDP traffic Victims with very large traffic volume Divert just traffic from a certain block, or geographical region (based on IP Location) 19
20 Public Facing Servers Surgical Diversion for Data Centers Optimizing the Mitigation of Application-Layer DDoS Attacks On-demand or continuous mitigation of selective traffic Benefits of continuous DPI traffic scrubbing without the risks and demands of in-line deployments. Legitimate Users Flowspec GRT Firewall / IPS / WAF Attackers VRF I D M S Backbone / Internet Data Center Network 20
21 BGP Flowspec Diversion Work in Progress New Redirect to IP Next-Hop Flowspec Action Described in draft-simpson-idr-flowspec-redirect-02.txt [4] New Extended Community value 0x0800 Enables BGP flowspec redirection using encapsulations other than VRFs, such as GRE or MPLS tunnels. Scrubbing Center Mitigation Appliance Victim MPLS or GRE Tunnel Enterprise or IDC 21
22 Summary Surgical Diversion Benefits Using BGP Flowspec: Greatly simplifies traffic diversion design and operation: Less intrusive to the routing system no changes to the Global Routing Table (GRT). On the reinjection side, there is no need to use tunneling (GRE) or VRF designs. Optimizes the benefits of a DDoS Mitigation Appliance ( surgical mitigation ) with precise diversion: Allows for a better optimization of the shared mitigation capacity of the mitigation appliance. Addresses demanding mitigation use cases. On-demand & continuous scrubbing per application or other criteria. 22
23 References: [1] RFC 5575, Dissemination of Flow Specification Rules [2] draft-ietf-idr-flow-spec-v6-03 Dissemination of Flow Specification Rules for IPv6 [3] draft-ietf-idr-bgp-flowspec-oid-01 Revised Validation Procedure for BGP Flow Specifications [4] draft-simpson-idr-flowspec-redirect-02.txt BGP Flow-Spec Extended Community for Traffic Redirect to IP Next Hop [5] Arbor Networks 2012 Worldwide Infrastructure Security Report, Volume VIII [6] NANOG 38, D. Gassen, R. Lozano (Time Warner Telecom), D. McPherson, C. Labovitz (Arbor Networks), "BGP Flow Specification Deployment Experience [7] LINX69, Thomas Mangin (Exa Networks), Andy Davidson (NetSumo), "BGP Route Injection [8] GTER/GTS 2007, Raniery Pontes (RNP), Flowspec em ação - Experiência de uso no backbone da RNP 23
24
25
Firewall-on-Demand. GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF. Leonidas Poulopoulos
Firewall-on-Demand GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF Leonidas Poulopoulos 1 leopoul@nocgrnetgr 1 NOC/Greek Research and Technology Network
More informationScalable DDoS mitigation using BGP Flowspec
Scalable DDoS mitigation using BGP Flowspec Wei Yin TAY Consulting Systems Engineer Cisco Systems 2010 Cisco and/or its affiliates. All rights reserved. Goals of DDoS Mi,ga,on Problem descrip,on Tradi,onal
More informationDDoS Mitigation Techniques
DDoS Mitigation Techniques Ron Winward, ServerCentral CHI-NOG 03 06/14/14 Consistent Bottlenecks in DDoS Attacks 1. The server that is under attack 2. The firewall in front of the network 3. The internet
More informationSecurityDAM On-demand, Cloud-based DDoS Mitigation
SecurityDAM On-demand, Cloud-based DDoS Mitigation Table of contents Introduction... 3 Why premise-based DDoS solutions are lacking... 3 The problem with ISP-based DDoS solutions... 4 On-demand cloud DDoS
More informationHunting down a DDOS attack
2006-10-23 1 Hunting down a DDOS attack By Lars Axeland +46 70 5291530 lars.axeland@teliasonera.com 2006-10-23 What we have seen so far What can an operator do to achieve core security What solution can
More informationDDoS Protection. How Cisco IT Protects Against Distributed Denial of Service Attacks. A Cisco on Cisco Case Study: Inside Cisco IT
DDoS Protection How Cisco IT Protects Against Distributed Denial of Service Attacks A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge: Prevent low-bandwidth DDoS attacks coming from a broad
More informationArbor s Solution for ISP
Arbor s Solution for ISP Recent Attack Cases DDoS is an Exploding & Evolving Trend More Attack Motivations Geopolitical Burma taken offline by DDOS attack Protests Extortion Visa, PayPal, and MasterCard
More informationF5 Silverline DDoS Protection Onboarding: Technical Note
F5 Silverline DDoS Protection Onboarding: Technical Note F5 Silverline DDoS Protection onboarding F5 Networks is the first leading application services company to offer a single-vendor hybrid solution
More informationFirewall on Demand Multidomain
Firewall on Demand Multidomain S E C U R I T Y V I A B G P F L O W S P E C & A W E B P L A T F O R M Leonidas Poulopoulos GRNET NOC Wayne Routly DANTE Jeffrey Haas JUNIPER Firewall on Demand Multidomain
More informationAttacks Against the Cloud: A Mitigation Strategy. Cloud Attack Mitigation & Firewall on Demand
Attacks Against the Cloud: A Mitigation Strategy C L O U D A T T A C K M I T I G A T I O N & F I R E W A L L O N D E M A N D A l e x Z a c h a r i s a z a h a r i s @ a d m i n. g r n e t. g r G R N E
More informationHOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest
More informationAvailability Digest. www.availabilitydigest.com. Prolexic a DDoS Mitigation Service Provider April 2013
the Availability Digest Prolexic a DDoS Mitigation Service Provider April 2013 Prolexic (www.prolexic.com) is a firm that focuses solely on mitigating Distributed Denial of Service (DDoS) attacks. Headquartered
More informationDEFENSE NETWORK FAQS DATA SHEET
DATA SHEET VERISIGN INTERNET DEFENSE NETWORK FAQS WHAT IS A DOS OR DDOS ATTACK? A Denial of Service attack or Distributed Denial of Service attack occurs when a single host (DoS), or multiple hosts (DDoS),
More informationHow Cisco IT Protects Against Distributed Denial of Service Attacks
How Cisco IT Protects Against Distributed Denial of Service Attacks Cisco Guard provides added layer of protection for server properties with high business value. Cisco IT Case Study / < Security and VPN
More informationHow To Block A Ddos Attack On A Network With A Firewall
A Prolexic White Paper Firewalls: Limitations When Applied to DDoS Protection Introduction Firewalls are often used to restrict certain protocols during normal network situations and when Distributed Denial
More informationIS-IS Extensions for Flow Specification
IS-IS Extensions for Flow Specification draft-you-isis-flowspec-extensions-01 Jianjie You (youjianjie@huawei.com) Qiandeng Liang (liangqiandeng@huawei.com) Keyur Patel (keyupate@cisco.com) Peng Fan (fanpeng@chinamobile.com)
More informationKASPERSKY DDOS PROTECTION. Discover how Kaspersky Lab defends businesses against DDoS attacks
KASPERSKY DDOS PROTECTION Discover how Kaspersky Lab defends businesses against DDoS attacks CYBERCRIMINALS ARE TARGETING BUSINESSES If your business has ever suffered a Distributed Denial of Service (DDoS)
More informationApproaches for DDoS an ISP Perspective. barry@null0.net ognian.mitev@viawest.com
Approaches for DDoS an ISP Perspective barry@null0.net ognian.mitev@viawest.com Home School How everyone starts It s all up to you It s inexpensive (compared to other forms of education) Quality may not
More informationDESTINATION BASED RTBH FILTERING AT ATTACK ORIGINATING INTERNET SERVICE PROVIDER
DESTINATION BASED RTBH FILTERING AT ATTACK ORIGINATING INTERNET SERVICE PROVIDER Sarita Sharma 1, Davender Saini 2 1 Student M. Tech. ECE (2013-2015) Gurgaon Institute of Technology Management (M.D.U)
More informationMANAGED SECURITY SERVICES : IP AGNOSTIC DDOS AN IP AGNOSTIC APPROACH TO DISTRIBUTED DENIAL OF SERVICE DETECTION AND MITIGATION
AN IP AGNOSTIC APPROACH TO DISTRIBUTED DENIAL OF SERVICE DETECTION AND MITIGATION Overview Distributed Denial of Service (DDoS) attacks saturate target networks with service requests that consume the capacity
More informationStop DDoS Attacks in Minutes
PREVENTIA Forward Thinking Security Solutions Stop DDoS Attacks in Minutes 1 On average there are more than 7,000 DDoS attacks observed daily. You ve seen the headlines. Distributed Denial of Service (DDoS)
More informationVERISIGN DDOS PROTECTION SERVICES IN-THE-CLOUD SOLUTION FOR SCALABLE, RELIABLE, AND FLEXIBLE DDOS MONITORING AND MITIGATION
WHITE PAPER VERISIGN DDOS PROTECTION SERVICES IN-THE-CLOUD SOLUTION FOR SCALABLE, RELIABLE, AND FLEXIBLE DDOS MONITORING AND MITIGATION VerisignInc.com CONTENTS DDOS GAINING GROUND ON ALL FRONTS 3 THE
More informationService Description DDoS Mitigation Service
Service Description DDoS Mitigation Service Interoute, Walbrook Building, 195 Marsh Wall, London, E14 9SG, UK Tel: +800 4683 7681 Email: info@interoute.com Contents Contents 1 Introduction...3 2 An Overview...3
More informationAutomated Mitigation of the Largest and Smartest DDoS Attacks
Datasheet Protection Automated Mitigation of the Largest and Smartest Attacks Incapsula secures websites against the largest and smartest types of attacks - including network, protocol and application
More informationProtect your network: planning for (DDoS), Distributed Denial of Service attacks
Protect your network: planning for (DDoS), Distributed Denial of Service attacks Nov 19, 2015 2015 CenturyLink. All Rights Reserved. The CenturyLink mark, pathways logo and certain CenturyLink product
More informationDDoS Mitigation via Regional Cleaning Centers
SPRINT ATL RESEARCH REPORT RR04-ATL-013177 - JANUARY 2004 1 DDoS Mitigation via Regional Cleaning Centers Sharad Agarwal Travis Dawson Christos Tryfonas University of California, Berkeley Sprint ATL Kazeon
More informationDDoS Threat Report. Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter
DDoS Threat Report Insights on Finding, Fighting, and Living with DDoS Attacks v1.1 Chris Beal Chief Security Architect MCNC chris.beal@mcnc.org @mcncsecurity on Twitter DDoS in the News - 2014 DDoS Trends
More informationFortiDDos Size isn t everything
FortiDDos Size isn t everything Martijn Duijm Director Sales Engineering April - 2015 Copyright Fortinet Inc. All rights reserved. Agenda 1. DDoS In The News 2. Drawing the Demarcation Line - Does One
More informationSHARE THIS WHITEPAPER. Top Selection Criteria for an Anti-DDoS Solution Whitepaper
SHARE THIS WHITEPAPER Top Selection Criteria for an Anti-DDoS Solution Whitepaper Table of Contents Top Selection Criteria for an Anti-DDoS Solution...3 DDoS Attack Coverage...3 Mitigation Technology...4
More information/ Staminus Communications
/ Staminus Communications Global DDoS Mitigation and Technology Provider Whitepaper Series True Cost of DDoS Attacks for Hosting Companies The most advanced and experienced DDoS mitigation provider in
More informationMPLS VPN over mgre. Finding Feature Information. Prerequisites for MPLS VPN over mgre
The feature overcomes the requirement that a carrier support multiprotocol label switching (MPLS) by allowing you to provide MPLS connectivity between networks that are connected by IP-only networks. This
More informationBGP DDoS Mitigation. Gunter Van de Velde. Sr Technical Leader NOSTG, Cisco Systems. May 2013. 2012 Cisco and/or its affiliates. All rights reserved.
BGP DDoS Mitigation Gunter Van de Velde Sr Technical Leader NOSTG, Cisco Systems May 2013 2012 Cisco and/or its affiliates. All rights reserved. 1 A simple DDoS mitigation mechanism explained Bertrand
More informationMitigating DDoS Attacks at Layer 7
Mitigating DDoS Attacks at Layer 7 Detect, Localize and Mitigate using DNS GSLB Allan Jude ScaleEngine Inc. Introductions Allan Jude 12 Years as FreeBSD Server Admin Architect of the ScaleEngine CDN (HTTP
More informationTDC s perspective on DDoS threats
TDC s perspective on DDoS threats DDoS Dagen Stockholm March 2013 Lars Højberg, Technical Security Manager, TDC TDC in Sweden TDC in the Nordics 9 300 employees (2012) Turnover: 26,1 billion DKK (2012)
More informationPravail 2.0 Technical Overview. Exclusive Networks
Pravail 2.0 Technical Overview Exclusive Networks Pravail Features and Benefits Arbor Pravail APS is the a CPE-based security appliance focused on stopping availability threats Arbor Pravail APS Arbor
More informationNetwork provider filter lab
Network provider filter lab Olof Hagsand Pehr Söderman KTH CSC Group Nr Name 1 Name 2 Name 3 Name 4 Date Instructor s Signature Table of Contents 1 Goals...3 2 Introduction...3 3 Preparations...3 4 Lab
More informationOpenDaylight Project Proposal Dynamic Flow Management
OpenDaylight Project Proposal Dynamic Flow Management Ram (Ramki) Krishnan, Varma Bhupatiraju et al. (Brocade Communications) Sriganesh Kini et al. (Ericsson) Debo~ Dutta, Yathiraj Udupi (Cisco) 1 Table
More informationIntroduction to MPLS-based VPNs
Introduction to MPLS-based VPNs Ferit Yegenoglu, Ph.D. ISOCORE ferit@isocore.com Outline Introduction BGP/MPLS VPNs Network Architecture Overview Main Features of BGP/MPLS VPNs Required Protocol Extensions
More informationSolution Brief. Combating Bots and Mitigating DDoS Attacks
Solution Brief Combating Bots and Mitigating DDoS Attacks Combating Bots and Mitigating DDoS Attacks Page Many of today s distributed denial of service (DDoS) 1 attacks are carried out by organized criminals
More informationDemonstrating the high performance and feature richness of the compact MX Series
WHITE PAPER Midrange MX Series 3D Universal Edge Routers Evaluation Report Demonstrating the high performance and feature richness of the compact MX Series Copyright 2011, Juniper Networks, Inc. 1 Table
More informationDDoS Mitigation Solutions
DDoS Mitigation Solutions The Real Cost of DDOS Attacks Hosting, including colocation at datacenters, dedicated servers, cloud hosting, shared hosting, and infrastructure as a service (IaaS) supports
More informationwww.prolexic.com Stop DDoS Attacks in Minutes
www.prolexic.com Stop DDoS Attacks in Minutes Prolexic gives us the strong insurance policy against DDoS attacks that we were looking for. Mark Johnson, Chief Financial Officer, RealVision You ve seen
More informationBeing Ready to Face DDoS Challenge. Vodafone Power to you. DDoS
Being Ready to Face DDoS Challenge Vodafone Power to you DDoS 02 Introduction With competitive pressures intensifying and the pace of innovation accelerating, recognising key trends, understanding their
More informationSecuring data centres: How we are positioned as your ISP provider to prevent online attacks.
Securing data centres: How we are positioned as your ISP provider to prevent online attacks. Executive Summary In today s technologically-demanding world, an organisation that experiences any internet
More informationProtection Solution. Strategic White Paper
Alcatel-Lucent Integrated DDoS Protection Solution Strategic White Paper Table of contents 1. DDoS Attacks Increasing in Sophistication and Scale / 1 2. DDoS Threat Landscape & Impacts / 2 2.2 Impact on
More informationIncrease Simplicity and Improve Reliability with VPLS on the MX Series Routers
SOLUTION BRIEF Enterprise Data Center Interconnectivity Increase Simplicity and Improve Reliability with VPLS on the Routers Challenge As enterprises improve business continuity by enabling resource allocation
More informationAutomated Mitigation of the Largest and Smartest DDoS Attacks
Datasheet Protection Automated Mitigation of the Largest and Smartest Attacks Incapsula secures websites against the largest and smartest types of attacks - including network, protocol and application
More informationDISTRIBUTED DENIAL OF SERVICE OBSERVATIONS
: DDOS ATTACKS DISTRIBUTED DENIAL OF SERVICE OBSERVATIONS 1 DISTRIBUTED DENIAL OF SERVICE OBSERVATIONS NTT is one of the largest Internet providers in the world, with a significant share of the world s
More informationVersatile Routing and Services with BGP. Understanding and Implementing BGP in SR-OS
Brochure More information from http://www.researchandmarkets.com/reports/2720838/ Versatile Routing and Services with BGP. Understanding and Implementing BGP in SR-OS Description: Design a robust BGP control
More informationHow To Stop A Ddos Attack On A Network From Tracing To Source From A Network To A Source Address
Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty 2 June 2003 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations, conclusions, and
More informationIP/MPLS-Based VPNs Layer-3 vs. Layer-2
Table of Contents 1. Objective... 3 2. Target Audience... 3 3. Pre-Requisites... 3 4. Introduction...3 5. MPLS Layer-3 VPNs... 4 6. MPLS Layer-2 VPNs... 7 6.1. Point-to-Point Connectivity... 8 6.2. Multi-Point
More informationUNDERSTANDING JUNOS OS NEXT-GENERATION MULTICAST VPNS
WHITE PAPER UNDERSTANDING JUNOS OS NEXT-GENERATION MULTICAST VPNS Copyright 2010, Juniper Networks, Inc. 1 Table of Contents Executive Summary.............................................................................................
More informationIPv6 over IPv4/MPLS Networks: The 6PE approach
IPv6 over IPv4/MPLS Networks: The 6PE approach Athanassios Liakopoulos Network Operation & Support Manager (aliako@grnet.gr) Greek Research & Technology Network (GRNET) III Global IPv6 Summit Moscow, 25
More informationThe benefits of BGP for every service provider
The benefits of BGP for every service provider UKUUG - Spring 2011 24th of March 2011 Thomas Mangin Exa Networks Whatever a speaker is missing in depth he will compensate for in length Montesquieu NO Networking
More informationTransition to IPv6 in Service Providers
Transition to IPv6 in Service Providers Jean-Marc Uzé Director Product & Technology, EMEA juze@juniper.net UKNOF14 Workshop Imperial college, London, Sept 11 th, 2009 1 Agenda Planning Transition Transition
More informationDDoS Overview and Incident Response Guide. July 2014
DDoS Overview and Incident Response Guide July 2014 Contents 1. Target Audience... 2 2. Introduction... 2 3. The Growing DDoS Problem... 2 4. DDoS Attack Categories... 4 5. DDoS Mitigation... 5 1 1. Target
More informationNetwork Virtualization Network Admission Control Deployment Guide
Network Virtualization Network Admission Control Deployment Guide This document provides guidance for enterprises that want to deploy the Cisco Network Admission Control (NAC) Appliance for their campus
More informationMaking the Internet fast, reliable and secure. DE-CIX Customer Summit - 2014. Steven Schecter <schecter@akamai.com>
Making the Internet fast, reliable and secure DE-CIX Customer Summit - 2014 Steven Schecter What is a Content Distribution Network RFCs and Internet Drafts define a CDN as: Content
More informationDistributed Denial of Service protection
Distributed Denial of Service protection The cost in terms of lost business caused by a successful DDoS attacks can be significant. Our solution recognises when a DDoS attack is happening and identifies
More informationInternet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
More informationCS 457 Lecture 19 Global Internet - BGP. Fall 2011
CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with
More information2012 Infrastructure Security Report. 8th Annual Edition Kleber Carriello Consulting Engineer
2012 Infrastructure Security Report 8th Annual Edition Kleber Carriello Consulting Engineer Key Findings in the Survey* Advanced Persistent Threats (APT) a top concern for service providers and enterprises
More informationIntroduction Inter-AS L3VPN
Introduction Inter-AS L3VPN 1 Extending VPN services over Inter-AS networks VPN Sites attached to different MPLS VPN Service Providers How do you distribute and share VPN routes between ASs Back- to- Back
More informationFireCircle: GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF
FireCircle: GRNET s approach to advanced network security services management via bgp flow-spec and NETCONF Leonidas Poulopoulos Network Applications Developer (leopoul@noc.grnet.gr) Michalis Mamalis Network
More informationExterior Gateway Protocols (BGP)
Exterior Gateway Protocols (BGP) Internet Structure Large ISP Large ISP Stub Dial-Up ISP Small ISP Stub Stub Stub Autonomous Systems (AS) Internet is not a single network! The Internet is a collection
More informationDDoS attacks in CESNET2
DDoS attacks in CESNET2 Ondřej Caletka 15th March 2016 Ondřej Caletka (CESNET) DDoS attacks in CESNET2 15th March 2016 1 / 22 About CESNET association of legal entities, est. 1996 public and state universities
More informationEnabling Solutions in Cloud Infrastructure and for Network Functions Virtualization
Enabling Solutions in Cloud Infrastructure and for Network Functions Virtualization Gateway Use Cases for Virtual Networks with MX Series Routers 1 Table of Contents Executive Summary... 3 Introduction...4
More informationState of Texas. TEX-AN Next Generation. NNI Plan
State of Texas TEX-AN Next Generation NNI Plan Table of Contents 1. INTRODUCTION... 1 1.1. Purpose... 1 2. NNI APPROACH... 2 2.1. Proposed Interconnection Capacity... 2 2.2. Collocation Equipment Requirements...
More informationJUNOS DDoS SECURE. Advanced DDoS Mitigation Technology
JUNOS DDoS SECURE Advanced DDoS Mitigation Technology Biography Nguyen Tien Duc ntduc@juniper.net, +84 903344505 Consulting Engineer- Viet Nam CISSP # 346725 CISA # 623462 2 Copyright 2013 Juniper Networks,
More informationInter-domain Routing Basics. Border Gateway Protocol. Inter-domain Routing Basics. Inter-domain Routing Basics. Exterior routing protocols created to:
Border Gateway Protocol Exterior routing protocols created to: control the expansion of routing tables provide a structured view of the Internet by segregating routing domains into separate administrations
More informationDDoS attacks on electronic payment systems. Sean Rijs and Joris Claassen Supervisor: Stefan Dusée
DDoS attacks on electronic payment systems Sean Rijs and Joris Claassen Supervisor: Stefan Dusée Scope High volume DDoS attacks Electronic payment systems Low bandwidth requirements: 5 from account X to
More informationDDOS in academic Networks. Herramientas para la seguridad prevención y mitigación de DDOS. CSUC. 3 de Abril 2014
DDOS in academic Networks Herramientas para la seguridad prevención y mitigación de DDOS. CSUC. 3 de Abril 2014 Academic networks? Real Target for DDOS? Lesson learned; DDOS @RedIRIS Mitigation Projects
More informationAppendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
More informationCampus LAN at NKN Member Institutions
Campus LAN at NKN Member Institutions RS MANI rsm@nkn.in 1/7/2015 3 rd Annual workshop 1 Efficient utilization Come from: Good Campus LAN Speed Segregation of LANs QoS Resilient Access Controls ( L2 and
More informationData Sheet. DPtech Anti-DDoS Series. Overview
Data Sheet DPtech Anti-DDoS Series DPtech Anti-DDoS Series Overview DoS (Denial of Service) leverage various service requests to exhaust victims system resources, causing the victim to deny service to
More informationFour Considerations for Addressing the DDoS Risk for Carrier and Cloud Hosting Providers
Four Considerations for Addressing the DDoS Risk for Carrier and Cloud Hosting Providers Whitepaper SHARE THIS WHITEPAPER Table of Contents The Rising Threat of Cyber-Attack Downtime...3 Four Key Considerations
More informationIhr Standort bleibt erreichbar. Ihre Applikationen bleiben erreichbar!
Ihr Standort bleibt erreichbar. Ihre Applikationen bleiben erreichbar! Die hybride DDoS Protection und Application Security Lösung von F5 Networks Arrow Sommerforum München am 16. Juli 2015 e.kampmann@f5.com
More informationMPLS WAN Explorer. Enterprise Network Management Visibility through the MPLS VPN Cloud
MPLS WAN Explorer Enterprise Network Management Visibility through the MPLS VPN Cloud Executive Summary Increasing numbers of enterprises are outsourcing their backbone WAN routing to MPLS VPN service
More informationIPV6 FRAGMENTATION. The Case For Deprecation. Ron Bonica NANOG58
IPV6 FRAGMENTATION The Case For Deprecation Ron Bonica NANOG58 BACKGROUND 2 Copyright 2013 Juniper Networks, Inc. www.juniper.net STATUS QUO In order to send a packet larger than the PMTU, an IPv6 node
More informationBuilding a small Data Centre
Building a small Data Centre Cause we re not all Facebook, Google, Amazon, Microsoft Karl Brumund, Dyn RIPE71 1 Dyn what we do DNS, email, Internet Intelligence from where 28 sites, 100s of probes, clouds
More informationVALIDATING DDoS THREAT PROTECTION
VALIDATING DDoS THREAT PROTECTION Ensure your DDoS Solution Works in Real-World Conditions WHITE PAPER Executive Summary This white paper is for security and networking professionals who are looking to
More informationHow To Make A Network Secure
1 2 3 4 -Lower yellow line is graduate student enrollment -Red line is undergradate enrollment -Green line is total enrollment -2008 numbers are projected to be near 20,000 (on-campus) not including distance
More informationService Provider Solutions. DDoS Protection Solution. Enabling Clean Pipes Capabilities
Service Provider Solutions Enabling Clean Pipes Capabilities June 2005 1 Service Provider Security Highlights Security is the heart of internetworking s future A secure infrastructure forms the foundation
More informationInternet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
More informationKASPERSKY DDoS PROTECTION. Protecting your business against financial and reputational losses with Kaspersky DDoS Protection
KASPERSKY DDoS PROTECTION Protecting your business against financial and reputational losses A Distributed Denial of Service (DDoS) attack is one of the most popular weapons in the cybercriminals arsenal.
More informationSHARE THIS WHITEPAPER. On-Premise, Cloud or Hybrid? Approaches to Mitigate DDoS Attacks Whitepaper
SHARE THIS WHITEPAPER On-Premise, Cloud or Hybrid? Approaches to Mitigate DDoS Attacks Whitepaper Table of Contents Overview... 3 Current Attacks Landscape: DDoS is Becoming Mainstream... 3 Attackers Launch
More informationTutorial: Options for Blackhole and Discard Routing. Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia
Tutorial: Options for Blackhole and Discard Routing Joseph M. Soricelli Wayne Gustavus NANOG 32, Reston, Virginia Caveats and Assumptions The views presented here are those of the authors and they do not
More informationDDoS Mitigation Strategies
DDoS Mitigation Strategies Internet2 Security Working Group 23 Feb 2016 Mark Beadles Information Security Officer mbeadles@oar.net Kevin Nastase Network Security Engineer knastase@oar.net www.oar.net Slide
More information