Comment by dijit
1 day ago
you don’t stop the message to the botnet, thats impossible:
You detect the behaviour downstream and send a signal to the ISP that there is traffic that needs to he rate limited.
One mechanism for this is called RTBH (Remote Triggered BlackHole) which relies on community tagged prefixes of addresses exceeding rate limited to be blackholed from forwarding traffic further in to the internet.
There’s also things like flowspec but a lot of things rely on proper trust between ASNs.
It's not that simple and hasn't been for awhile.
There's layer upon layer of relays now, and meshed C2C networks.
Lots of DNS fastflux too
How do you know where it comes from, if they use UDP and change the src of the packets.
IP spoofing is pretty uncommon nowadays because everyone has anti-spoofing mechanisms in place and most ASNs often don't forward spoofed addresses outbound.
But as the sibling mentioned, even with spoofing, you can still follow the packet trail from your border routers upstream. I think the main thing we are lacking is just responsibility on the ISP side, if someone reaches out complaining that half of your customers are sending ddos attacks, maybe you need to do something about it. Most of these huge attacks are compromised routers or IoT devices (remember Mirai Botnet?).
This is clearly not true, or the CAIDA anti-spoofer project wouldn't exist.
https://spoofer.caida.org/summary.php
1 reply →
The Microsoft blog suggests there was miminal source spoofing (although I don't know how they determine that). But if you can't trust the IP source, packet samples from your border router should indicate which upstream is sending those packets ... then you ask them to find the source... eventually you'll get somewhere ... but when the sources are distributed, it's not so helpful to find the source, unless there's a mechanism to stop the source from sending it.
When I was running servers that would routinely attract DDoSed at ~ 10 Gbps, I ended up always running a low sample rate packet capture. Anytime I noticed a DDoS, I could go and look at the packets. If you've got connectivity to sink and measure 15 Tbps of DDoS, you can probably influence your providers to take some sampled packet captures and look at them too.
Even without clear information from packet captures, 15 Tbps is going to make an impact on traffic graphs, and you can figure out sources from those, although it might be a bit tricky because the attack duration was reported at only 40 seconds, so if someone only has hourly stats, it might be too small to be noticed; but once a minute stats are pretty common.