[70602] in North American Network Operators' Group
handling ddos attacks
daemon@ATHENA.MIT.EDU (Mark Kent)
Thu May 20 14:52:33 2004
Date: Thu, 20 May 2004 11:52:01 -0700 (PDT)
From: Mark Kent <mark@noc.mainstreet.net>
To: nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
I've been trying to find out what the current BCP is for handling ddos
attacks. Mostly what I find is material about how to be a good
net.citizen (we already are), how to tune a kernel to better withstand
a syn flood, router stuff you can do to protect hosts behind it, how
to track the attack back to the source, how to determine the nature of
the traffic, etc.
But I don't care about most of that. I care that a gazillion
pps are crushing our border routers (7206/npe-g1).
Other than getting bigger routers, is it still the case that the best
we can do is identify the target IP (with netflow, for example) and
have upstreams blackhole it?
Thanks,
-mark
