Title
ISP facing a two-week distributed DDoS attack wave used FLOWCUTTER to see each attack vector and filter what the scrubbing appliance couldn't catch, until the attacks stopped.
Situation
A European country was going through a wave of DDoS attacks tied to ransomware campaigns, hitting network operators nationwide.
The customer deployed FLOWCUTTER in the middle of this wave. Within a few hours, the first alerts for active attacks came in. The attacks used several vectors, including SYN floods, TCP SYN request floods and UDP fragment floods.
Challenge
The customer already had a dedicated DDoS scrubbing appliance in place. This was a distributed DDoS attack in the full sense: the traffic came from a large number of source IPs and ASNs rather than from a few concentrated sources.
Spread this thin, much of the attack traffic slipped past the scrubbing appliance. The team needed to see what each wave looked like as it happened: protocol, ports, source patterns and targets.
Solution
FLOWCUTTER added the traffic context behind each alert. For every attack, the team could drill down into the vector and act on that evidence.
There was no single rule that would stop everything at once. Instead, the team progressively filtered and blocked the parts of each wave that the scrubbing appliance wasn't catching.
Results
Over about two weeks, the customer faced many distinct attack waves and cut each of them down using flow-based evidence.
Eventually, the attacks against the customer's AS and IP ranges stopped, and the campaign moved on.
Resources
- Anomaly detection (SYN flood, UDP fragment flood)
- NetFlow analysis in Grafana
- Drill-down and mitigation workflow
Takeaway
Scrubbing and flow-based diagnostics answer different questions. When a distributed DDoS attack slips past scrubbing, flow data shows what each wave actually looks like. The team can then cut it down wave after wave, until the network is no longer an easy target.