Last night, we got hit by a ~3 Gbps DDoS attack. It's been a while since
this has happened to us, so I'd like to make sure I'm still up on the
state of the art.

Is there anything more to be done than the following?
     1. Identify the victim.
     2. Null route the victim.
     3. Propagate the null route to your upstreams (via BGP, if
        supported, otherwise a phone call to their NOC).
     4. Move the victim to a new IP.


To avoid participating in at least some classes of DDoS attacks, we:
      * long ago implemented uRPF (and/or similar ACLs) to block spoofed
        outbound packets, as recommended by BCP 38 (RFC 2827).
      * ensured our NTP servers (and any NTP servers of our customers)
        are not responding to monlist queries. The openntpproject.org
        website is useful here. They list vulnerable NTP servers by IP
        range, or you can get all NTP servers by AS (replace YOUR_AS
        with your AS, and optionally, add &csv=1) and then query with
        ntpdc -n -c monlist IP:
        http://openntpproject.org/searchby-asn.cgi?search_asn=YOUR_AS
      * just this week started addressing customers with open DNS
        resolvers, which can also be used in amplification attacks:
        http://openresolverproject.org/searchby-asn.cgi?search_asn=YOUR_AS

Is there anything else we should be doing?

--
Richard

########################################################################

To unsubscribe from the MICE-DISCUSS list, click the following link:
http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1