Home page logo

nanog logo nanog mailing list archives

RE: UDP port 80 DDoS attack
From: George Bonser <gbonser () seven com>
Date: Wed, 8 Feb 2012 09:51:15 +0000

From: Keegan Holley 
Subject: Re: UDP port 80 DDoS attack

It works in theory, but to get every ISP and hosting provider to ACL their edges and maintain those ACL's for every 
customer no matter how large might be a bit difficult.  

You don't have to ACL in most cases. RPF works for most.  There will be a few, relatively darned few, that you will 
need to ACL, but RPF takes care of a large number of them.

Besides, I never meant to imply that this business was easy and not "difficult".

Also, what about non-BGP customers or customers that just accept a default route?  

I don't follow.  The ISP still knows what traffic gets routed TO them.  You only accept FROM them what you route TO 
them, even if you hand them a default route.

Or even customers that just want return traffic to come in a different link for some reason.

Still don't follow.  I am not talking about having a firewall that is stateful.  I am talking packet by packet.  If you 
don't route it to them, you don't accept it from them unless you have made arrangements otherwise, which will be a 
small percentage of your customers. Sure, some might be multihomed but it is easy enough to verify that they have the 
networks in question SWIPed to them or a call to the other provider can clear that up in a few minutes.  It isn't THAT 

ISP's would suddenly become giant traffic registries.

No, we have registries to act as registries, the ISPs should be checking them, and double checking.  It isn't something 
that is going to change every day or every week. Once you get it set up, it is going to be stable for a while.  Sure, 
it means a little more work in setting up a customer, but it also means that if all your neighbors do the same thing, 
you field many fewer calls dealing with stupid DoS crap.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]