DDOS Mitigation Help

[tdale1987]

Hello all,

I'm looking for some DDOS mitigation help. I've setup some blackhole services with my BGP peers and i'd like to see if anyone has a way to proactively null route possible incoming and outgoing ddos attacks. Aside from having a system like nagios alerting me my port is dead or worse it cannot reach the switch due to ping timeout. What can i setup to automate null routing of an ip traversing DDOS like traffic.

Any links or ideas would be great.

Thanks in advance for all your answers!

-Tom

[Philip D'Ath]

You will need a commercial product to do that.  You would also have to be very brave to automate something like that.

As long as you have some monitoring to show top hosts, top flows and top ports you should be able to block anything nasty quickly - that's assuming it doesn't match valid traffic that you can not block.

[tdale1987]

Can you name some products to shove me in the right direction? I don't even know where to start

[Philip D'Ath]

Arbor Networks is pretty popular.

https://www.arbornetworks.com/