Title
A UK ISP was hit by DDoS attacks 20 times in two days. Flow data in FLOWCUTTER showed the attack vector, and DDoS mitigation through upstream BGP communities ended the outages.
Situation
An ISP in the UK was targeted by a series of DDoS attacks, 20 times within two days.
Each attack, lasting an hour or more, overloaded the edge routers. During the attacks, all of the provider's customers lost internet access.
On the morning of the third day, a technician got in touch and installed FLOWCUTTER to see if it could help.
Challenge
Most attacks are short and can be waited out. This series made normal operation impossible, with the hotline full of angry customers for two days.
SNMP monitoring showed the overload, but not the details behind it. To be prepared for the next attack, the administrator needed to know:
- which method was used,
- who was attacking,
- what exactly was targeted.
Solution
This is where flow data helps. The ISP set up NetFlow export from its edge routers to FLOWCUTTER, analyzed the attack and then mitigated it.
Results
Incoming connections (flows per second) rose to 25 times the normal level.
Zooming in showed that the attack was fully distributed. It did not come from a few IP addresses or ASNs, but from tens of thousands of hosts around the world.
The packets used UDP and did not originate from or target any specific ports. The attack did, however, target just four IP addresses.
The whole bandwidth was saturated, so dropping packets to those four IPs on the firewall or edge router would not help. For DDoS mitigation, the ISP used BGP communities of its upstream providers, so traffic to the target IPs was not routed to the ISP's network at all.
Resources
- NetFlow analysis in Grafana
- Flow-based (D)DoS detection
- DDoS mitigation using BGP
Takeaway
Two days of distributed attacks ended once the ISP could see them. Flow data in FLOWCUTTER showed the attack vector, and DDoS mitigation through upstream BGP communities stopped the outages for its customers.