[183875] in North American Network Operators' Group
DDoS auto-mitigation best practices (for eyeball networks)
daemon@ATHENA.MIT.EDU (Frank Bulk)
Sat Sep 19 15:56:28 2015
X-Original-To: nanog@nanog.org
From: "Frank Bulk" <frnkblk@iname.com>
To: <nanog@nanog.org>
Date: Sat, 19 Sep 2015 14:54:24 -0500
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Could the community share some DDoS auto-mitigation best practices for
eyeball networks, where the target is a residential broadband subscriber?
I'm not asking so much about the customer communication as much as
configuration of any thresholds or settings, such as:
- minimum traffic volume before responding (for volumetric attacks)
- minimum time to wait before responding
- filter percentage: 100% of the traffic toward target (or if volumetric,
just a certain percentage)?
- time before mitigation is automatically removed
- and if the attack should recur shortly thereafter, time to respond and
remove again
- use of an upstream provider(s) mitigation services versus one's own
mitigation tools
- network placement of mitigation (presumably upstream as possible)
- and anything else
I ask about best practice for broadband subscribers on eyeball networks
because it's different environment than data center and hosting environments
or when one's network is being used to DDoS a target.
Regards,
Frank
