FortiDDos DDoS Attack Mitigation Guide - Fortinet

DDoS Attack Trends in 2012
SYN Floods will continue to grow
The size of SYN floods has been growing. SYN Floods are easiest to create and are
tough to mitigate as the size in terms of bandwidth grows.
There are many schemes for SYN Flood mitigation. Hardware logic based mitigation is
the only practical way to sustain large SYN floods. Software based solution, even
those deployed on blade-center platform, do not have the capability to perform SYN
flood mitigation at high data rates.
Hardware logic can perform anti-spoofing, depending on the size of the attack and
suitability, using:
• SYN Cookies
• ACK Cookies
• SYN Retransmission
Concurrent connection-based attacks will be on the rise
Botnet floods will be rising
It is easy for hackers to hire a botnet which runs scripts that open connections and
leave them in established state after performing a proper 3-way TCP handshake. A
limited number of connection from many such botnet machines can easily overwhelm
a server. When the number of these attacker IPs is small, you can use software scripts
to stop the attack using IPTABLES and TCPKILL like tools. You can try Nginx
constellation reverse proxy configuration and DNS round robin mechanism to reduce
the pressure. But practically, this doesn’t seem to work as it requires multiple machines
to be managed.
A hardware logic based solution which monitors all connections for behavioral
anomalies can easily stop such attacks and aggressively age them both internally and
from the servers by sending a TCP RST on behalf of the client.
Attacks mimicking legitimate users are on the rise. Even low-bandwidth of such
attacks seem to bring down the servers. Existing tools fail to stop such attacks
because they don’t have visibility and control over such behavioral attacks. Smarter
bots will be rising that will obfuscate most algorithmic systems.
Hardware logic which can look simultaneously granularly and deeply into the packet’s
network and application headers can stop such attacks by determining self-similarity
among packets at some level.
Volumetric and application layer DDoS attacks will be converging in 2011 onwards and
therefore require DDoS mitigation systems that can intelligently provide solutions for
both of them well.
FortiDDoS DDoS Attack Mitigation Guide
28-100-167076-20120501 10
http://docs.fortinet.com/ • Feedback