FortiDDos DDoS Attack Mitigation Guide - Fortinet

Anti-DDoS appliances
Anti-DDoS appliances
• Memory resources can be exhausted by filling up various kernel tables that are not
tuned to be sufficiently large. Ensure that you understand various kernel tables.
• Network card is gateway to the packets. Better network card means better handling
of large number of packets. Better network card driver means better performance.
• Choose a vendor such as Intel and model which is proven and a driver that’s
already hardened.
• Use NetFilter/iptables firewall to deny bad packets
• Use Hashlimit module to identify IPs that are consuming resources
• Use ipset module to block-lists of up to IP addresses that can be queried, loaded
and unloaded from user-space.
• Use command :netstat -plan|grep :80 |awk '{print $5}' |cut -d: -f1 |sort |uniq -c |sort
-n to find out if port 80 is being attacked by too many IPs.
• Use modules such as mod_evasive, mod_limitipconn to limit attacks from limited
number of IPs.
• Try mod_qos to improve quality of service.
• Apache has its limits. You can try LiteSpeed.
There are primarily following categories of appliances in the market for DDoS
mitigation:
Carrier DDoS mitigation solutions
• These solutions are useful for global networks and carriers and ISPs.
• They employ IP flow-based and deep packet inspection technologies, and protect
entire networks consisting of multiple routers and switches and services behind
them.
• An example of such solutions is Arbor Networks.
• These solutions are too expensive for individual IDCs, webhosts or web properties.
• These solutions have been designed around early 2000 and therefore are not
keeping up with the current generation of DDoS attacks which involve botnets that
mimic legitimate clients.
• These solutions work very well at global level and the residual attacks from such
solutions may be too much for an individual web property which in turn may have to
employ a solution such as 2 below.
Custom logic (FPGA or ASIC) based internet data center (IDC), web
hosting and web property DDoS mitigation solutions
• These solutions are useful for large IDCs, large web hosts and large web properties.
• They work to protect one or several Internet links.
• The behavioral solutions are implemented in custom hardware logic and provide
line rate performance for large attacks.
• The FortiDDoS device has one such solution.
• These solutions are cost-effective and effective for IDCs, webhosts and web
properties.
FortiDDoS DDoS Attack Mitigation Guide
28-100-167076-20120501 7
http://docs.fortinet.com/ • Feedback