DDOS, IDS, RTBH, and Rate limiting

[rdobbins at arbor.net (Roland Dobbins)]

On 9 Nov 2014, at 10:12, Jon Lewis wrote:

> The tricky part is when to remove the route...since you can't tell if 
> the attack has ended while the target is black holed by your 
> upstreams.

You can with NetFlow, if you've D/RTBHed the IP in question on your own 
infrastructure.  NetFlow reports statistics on dropped traffic (except 
on a few platforms with implementation deficiencies).

But this kind of thing punishes the victim.  It's far better to do 
everything possible to *protect* the target(s) of an attack, and only 
use D/RTBH as a last resort.

-----------------------------------
Roland Dobbins <rdobbins at arbor.net>