Community tools to fight against DDoS
1 like620 views
The document discusses community tools to combat Distributed Denial-of-Service (DDoS) attacks, focusing on detection and mitigation strategies. It introduces tools from Team Cymru, including bogon filter, flow sonar, and unwanted traffic removal service (UTRS), outlining their functionalities and configurations. The document emphasizes the importance of these tools for managing and filtering traffic to ensure legitimate service availability.
![Bogon Filter : Status
• The IPv4 traditional bogons list is currently 13
prefixes.
• fullbogons list is approximately 3,618 prefixes.
• The IPv6 fullbogons list is approximately 58,401
prefixes.
– [date : 18th May 2015]
bdNOG3 Conference | 18th May 2015 | Dhaka](https://image.slidesharecdn.com/communitytoolstofightagainstddos-150525051215-lva1-app6891/85/Community-tools-to-fight-against-DDoS-11-320.jpg)
Community tools to fight against DDoS
- 1. Community tools to fight against DDoS Fakrul Alam bdHUB Limited fakrul@bdhub.com
- 2. bdNOG3 Conference | 18th May 2015 | Dhaka
- 3. DDoS • Distributed denial-of-service (DDoS) attacks target network infrastructures or computer services by sending overwhelming number of service requests to the server from many sources. • Server resources are used up in serving the fake requests resulting in denial or degradation of legitimate service requests to be served bdNOG3 Conference | 18th May 2015 | Dhaka
- 4. Addressing DDoS attacks • Detection – Detect incoming fake requests • Mitigation – Diversion : Send traffic to a specialized device that removes the fake packets from the traffic stream while retaining the legitimate packets – Return : Send back the clean traffic to the server bdNOG3 Conference | 18th May 2015 | Dhaka
- 5. 3 Community tools from Team Cymru • Bogon Filter – https://www.team-cymru.org/bogon-reference.html • Flow Sonar – https://www.team-cymru.org/Flow-Sonar.html • UTRS (Unwanted Traffic Removal Service) – https://www.team-cymru.org/UTRS/index.html bdNOG3 Conference | 18th May 2015 | Dhaka
- 7. Bogon Filter • A bogon prefix is a route that should never appear in the Internet routing table – Bogons are defined as Martians (private and reserved addresses defined by RFC 1918, RFC 5735, and RFC 6598) and netblocks that have not been allocated to a RIR by the IANA • These are commonly found as the source addresses of DDoS attacks • Study shows 60% of the naughty packets were obvious bogons • Bogon and fullbogon lists are NOT static lists bdNOG3 Conference | 18th May 2015 | Dhaka
- 8. Bogon Filter : Configuration IPv4 bdNOG3 Conference | 18th May 2015 | Dhaka / you can forward these traffic and analyze /
- 9. Bogon Filter : Configuration IPv6 bdNOG3 Conference | 18th May 2015 | Dhaka / you can forward these traffic and analyze /
- 10. Bogon Filter : Output bdNOG3 Conference | 18th May 2015 | Dhaka
- 11. Bogon Filter : Status • The IPv4 traditional bogons list is currently 13 prefixes. • fullbogons list is approximately 3,618 prefixes. • The IPv6 fullbogons list is approximately 58,401 prefixes. – [date : 18th May 2015] bdNOG3 Conference | 18th May 2015 | Dhaka
- 12. Bogon Filter : Peering • Contact bogonrs@cymru.com 1. Which bogon types you wish to receive (traditional IPv4 bogons, IPv4 fullbogons, and/or IPv6 fullbogons) 2. Your AS number 3. The IP address(es) you want us to peer with 4. Does your equipment support MD5 passwords for BGP sessions? 5. Optional: your GPG/PGP public key • https://www.team-cymru.org/bogon-reference- bgp.html bdNOG3 Conference | 18th May 2015 | Dhaka
- 13. 2. Flow Sonar
- 14. Flow Sonar • The Team Cymru Flow Sonar system is a powerful tool for network managers to visually identify and understand what is happening on their network at any given time • Leveraging the free and open-source framework provided by Peter Haag of SWITCH • Special plugins "dosrannu" developed by Team Cymru to track malicious activity on your network • Unique dosrannu feeds alerted to DDoS attacks, compromised machines, and the presence of connections to C&C hosts bdNOG3 Conference | 18th May 2015 | Dhaka
- 15. Flow Sonar It’s nfsens/nfdump!!! bdNOG3 Conference | 18th May 2015 | Dhaka
- 16. Flow Sonar : Get It • Contact outreach@cymru.com 1. Team Cymru will send hardware • 1 Server • 1 Router • https://www.team-cymru.org/Flow-Sonar.html bdNOG3 Conference | 18th May 2015 | Dhaka
- 17. 3. UTRS (Unwanted Traffic Removal Service)
- 18. RTBH 101 CE IP : 1.2.3.4 BGP : 1.2.3.0/24 PE Transit I Transit II Provider InfraCustomer Infra Website Internet bdNOG3 Conference | 18th May 2015 | Dhaka
- 19. RTBH 101 CE IP : 1.2.3.4 BGP : 1.2.3.0/24 PE Transit I Transit II Provider InfraCustomer Infra Website Internet DDoS Traffic DDoS Traffic DDoS Traffic bdNOG3 Conference | 18th May 2015 | Dhaka
- 20. RTBH 101 CE IP : 1.2.3.4 BGP : 1.2.3.0/24 PE Transit I Transit II Provider InfraCustomer Infra Website Internet DDoS Traffic DDoS Traffic DDoS Traffic BGP : 1.2.3.4/32 COM : 65420:666 bdNOG3 Conference | 18th May 2015 | Dhaka
- 21. RTBH 101 CE IP : 1.2.3.4 BGP : 1.2.3.0/24 PE Transit I Transit II Provider InfraCustomer Infra Website Internet DDoS Traffic BGP : 1.2.3.4/32 COM : 65420:666 IP : 1.2.3.4/32 -> discard IP : 1.2.3.4/32 -> discard bdNOG3 Conference | 18th May 2015 | Dhaka
- 22. RTBH Upstream • Check whether your upsteam provider support RTBH • Configure & Test RTBH before incident • Only announce IPv4 /32's from address space you originate or your customer bdNOG3 Conference | 18th May 2015 | Dhaka
- 23. UTRS • It’s based on the basic principle of DDoS filtering; Remotely Triggered Black Hole Filtering • UTRS is a system that helps mitigate large infrastructure attacks by leveraging an existing network of cooperating BGP speakers such as ISPs, hosting providers and educational institutions that automatically distributes verified BGP-based filter rules from victim to cooperating networks bdNOG3 Conference | 18th May 2015 | Dhaka
- 24. UTRS : Configuration bdNOG3 Conference | 18th May 2015 | Dhaka Make sure you tag the route properly
- 25. UTRS : Apply • Newly launched service – Quite picky to choose whom to peer – Do organization verification • https://www.team-cymru.org/UTRS/index.html bdNOG3 Conference | 18th May 2015 | Dhaka
- 26. How UTRS varies from RTBH with upstream!
- 27. Other Efforts • NANOG BCOP : DDoS-DoS-attack-BCOP – http://bcop.nanog.org/index.php/DDoS-DoS-attack-BCOP bdNOG3 Conference | 18th May 2015 | Dhaka
- 28. Thank You