DDoS Mitigation Tools and Techniques

Transcript

1. DDoS Mitigation Tools and Techniques Babak Farrokhi MENOG 16
2. Introduction
3. What is a DDoS Attack? • A distributed attack that makes your online infrastructure totally inaccessible • Performed by a large number of infected hosts (zombies) • Complicated to defend Upstream Provider Your Infrastructure Your Connection Bots Bots Users
4. Attack Types Network Layer Attacks Exhausting your uplink Application Layer Attacks Overloading your servers Upstream Provider Your Infrastructure Your Connection Upstream Provider L7 Requests Your Infrastructure Your Connection
5. But I am not affected… ATTACKED MORE THAN ONCE 75% ATTACKED ON A WEEKLY BASIS 10% ATTACKED IN PAST 12 MONTHS 91% ORGANIZATIONS ATTACKED 45% Source: Imperva Q2 2015 DDoS Threat Landscape Report [1]
6. DDoS Attack Trends • 2014 vs. 2013 : Number of Attacked Doubled • Average DDoS Attack Size in 2014: 15Gbps • Average Damage of DDoS Attack: $40,000 /hour • Largest Application Layer Attack: ~180,000 RPS Source: Imperva Q2 2015 DDoS Threat Landscape Report [1]
7. Where are we going? • DDoS attacks may last for days or weeks • Attacks usually reappear • Network layer attacks are getting bigger (so, your defense should scale proportionally) • Operators should be equipped with appropriate equipment (and knowledge)
8. How it affects operators • Your customers cannot defend themselves (once attack hits a customer’s firewall, its too late) • Attack on one customer may affect the other customers, or the whole infrastructure • Loss of revenue • Loss of reputation • Legal Issues • Service Level degradation, missing SLA targets
9. Dealing with DDoS • Detection • Tools and Techniques • Mitigation • Best Practices
10. Detection
11. DDoS Detection • Network Telemetry • Passive traffic flow information collection • NetFlow • sFLOW • IPFIX • Real-time analysis • Baselining • Pattern Matching
12. Detection Toolbox • Commercial (Arbor, Juniper, F5, RadWare, Checkpoint, etc) • OpenSource: FastNetMon [9]
13. FastNetMon • Flow Data Analysis • NetFlow (v5, v9) • sFlow (v4, v5) • IPFIX • High Performance Traffic Capture • PF_RING • netmap • SnabbSwitch
14. • Watches hosts for traffic anomalies • High bits/second • High packets/second • High flows/second • Runs External Trigger (e.g. custom script)
15. • Integration with ExaBGP (FlowSpec injection) • Integration with GoBGP (Unicast announces) • Custom thresholds • L2TP Decapsulation • MPLS untagging and VLAN processing • Supports major network attack types (TCP SYN, UDP, ICMP and IP Fragmentation floods) • Write your own plugin!
16. Sample Configuration ## action in case of attack
 
 enable_ban = on
 ban_time = 3600
 
 ## Different approaches to attack detection
 
 ban_for_pps = on
 ban_for_bandwidth = on
 ban_for_flows = off
 
 ## Limits for Dos/DDoS attacks
 
 threshold_pps = 20000
 threshold_mbps = 1000
 threshold_flows = 3500
17. Sample Configuration ## traffic capture method
 
 mirror = off
 mirror_netmap = off
 pcap = off
 netflow = on
 sflow = on
 
 netflow_port = 2055
 netflow_host = 0.0.0.0
 
 sflow_port = 6343
 sflow_host = 0.0.0.0
18. Sample Configuration ## action !!!
 
 notify_script_path = /usr/local/bin/ban.sh
 
 
 # ExaBGP could announce blocked IPs with BGP
 
 exabgp = on
 exabgp_command_pipe = /var/run/exabgp/exabgp.cmd
 exabgp_community = 65001:666
 exabgp_next_hop = 10.0.3.114
 exabgp_announce_whole_subnet = no

19. Upstream A Upstream B IXP A IXP B Customer Network Target NOC ExaBGP FastNetMon NetFlow/sFlow Incoming DDoS
20. Upstream A Upstream B IXP A IXP B Customer Network Target NOC iBGP Advertise Blackhole Prefixes ExaBGP FastNetMon Block
21. FastNetMon at work
22. Mitigation
23. Mitigation Best Practices • S/RTBH [2] , D/RTBH [3] • FlowSpec [4] • Co-operative DDoS Mitigation [5] (IETF dots WG draft) • PBR
24. RTBH • Remotely Triggered Blackhole • D/RTBH: Based on destination address • S/RTBH: Based on source address • Widely in use by operators • Injecting routes to edge routers using iBGP to discard or redirect traffic to a sinkhole/scrubber • Blackholes all incoming traffic for a given host/network
25. D/RTBH • Victim’s (destination) address will be totally unreachable during attack • Makes victim unreachable to protect rest of the infrastructure / customers
26. S/RTBH • Uses uRPF (loose mode) to filter out traffic based on source address • Victim will be still reachable • Only effective in case of DoS or DDoS with limited number of source addresses
27. RTBH Upstream A Upstream B IXP A IXP B Customer Network Target Trigger Router NOC
28. RTBH Upstream A Upstream B IXP A IXP B Customer Network Target Trigger Router NOC
29. RTBH Upstream A Upstream B IXP A IXP B Customer Network Target Trigger Router NOC iBGP Advertise Blackhole Prefixes
30. Where should attack traffic go? • Discard • null0 on edge routers • Sinkhole • For further analysis / forensics • Scrubber • Clean malicious traffic
31. RTBH Problems • Discarding will keep target visible for local networks, but will be unavailable for others • Isn’t this what attackers wanted? • Scrubbing as an alternative to black-holing • It is usually done manually
32. BGP FlowSpec • Defined in RFC 5575 (IPv4) • Largely a work in progress - many extensions are proposed as IETF drafts • IPv6 support is still in draft state [6] (IETF idr WG) • Fairly new, not widely in use • JunOS 7.3 • IOS 15.5 , XE 3.14 • Defines a new BGP NLRI (Network Layer Reachability Information) format • Granular traffic flow matching based on L3/L4 information
33. FlowSpec use cases • Traffic Filter List / ACL distribution • Filtering harmful traffic based on Traffic Flow information • Replacement for classic S/RTBH and D/RTBH for DDoS mitigation
34. Flow Specification criteria • L3 Source / Destination Prefix • L4 Protocol (e.g. TCP, UDP, etc) • L4 Source / Destination Port • ICMP Types and Codes • TCP Flags • Packet Length • DSCP • Fragment
35. Traffic Filtering Actions • Defined as extended community attributes: • 0x8006 - traffic-rate (Rate Limiting or Discarding) • 0x8007 - traffic-action (Sampling) • 0x8008 - redirect (Redirecting to a VRF) • 0x8009 - traffic-marking (DSCP Tagging) • Additional actions are proposed [7]: • 0x8108 - redirect to IPv4 • 0x8208 - redirect to AS
36. ExaBGP • Open Source BGP Swiss Army Knife [8] • Supports many extensions, including IPv6, ASN4, MPLS, BMP and FlowSpec • Easy to use and extend (Show your Python / BASH mastery!) • Easily integrates with your existing tools/scripts (e.g. FastNetMon) to automate route/policy injection
37. Questions?
38. References
39. • [1] http://lp.incapsula.com/ddos-report-2015.html • [2] RFC 3882 - Configuring BGP to Block Denial-of-Service Attacks • [3] RFC 5635 - Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF) • [4] RFC 5575 - Dissemination of Flow Specification Rules • [5] draft-reddy-dots-transport-00 - Co-operative DDoS Mitigation • [6] draft-ietf-idr-flow-spec-v6 - Dissemination of Flow Specification Rules for IPv6
40. • [7] RFC 7674 - Clarification of the Flowspec Redirect Extended Community • [8] https://github.com/Exa-Networks/exabgp • [9] https://github.com/pavel-odintsov/fastnetmon