How the network responds to DDoS attacks

DDOS attacks cannot be solved

A company's network system is under DDoS attack, and its attack traffic is as high as 60 ~ 70 Mbps, attack packets reach 0.11 million pps, as shown in:

498) this. style. width = 498; "twffan =" done ">

Figure 1 attack traffic

It can be seen that only a small portion of the Internet traffic (green) is normal user traffic (basket line), and the above part of the basket line is DDoS attack traffic. If the bandwidth of a city company is relatively insufficient, serious network congestion will undoubtedly occur, resulting in a large area of user complaints.

Attack Packet Analysis

For attack traffic in Figure 2, capture the packet after the port image of the connected Internet cafe switch, and parse the attack packet.

498) this. style. width = 498; "twffan =" done ">

Figure 2 Analysis of Attack Packets

It can be seen that this attack sends a large number of malformed tcp packets without signs (the flag is set to all 0, highlighted in the red box in the figure) to the attacker. A large number of packets are used to consume Internet cafe server resources, resulting in the failure of Internet cafes to access the Internet normally.

Attack Prevention Measures

1. When encountering a DDoS attack, the filtering method that directly discards data packets is usually used. By changing the transmission direction of a data stream, it is discarded in a data "black hole" to block all data streams. The disadvantage of this method is that all data streams (whether legal or illegal) are discarded and business applications are suspended. Measures such as packet filtering and Rate limiting can also disable all applications and deny access to valid users. The result of this operation is obvious, that is, the hacker's wish is satisfied.

2. Install a professional firewall to filter illegal traffic

In the above attack instance, we set up anti-DDoS attack devices to filter illegal traffic. The topology Figure 3 shows a good effect, protecting the normal business of Internet cafes, however, the attack traffic is always routed to the firewall, occupying the bandwidth of the man.

498) this. style. width = 498; "twffan =" done ">

Figure 3 DDoS firewall Installation

3. normal business development is the most fundamental benefit for users. With the increasing dependence on the Internet, the dangers of DDoS attacks are also increasing. We can only recommend and appeal: early detection of System Attack vulnerabilities, timely installation of system patches, and continuous improvement of network security policies are all effective methods to prevent DDoS attacks.

Although DDoS-represented hacker attacks are still arrogant, in the foreseeable future, the security blade held by the majority of users will surely be able to cut off the DDoS claw.