FortiDDos DDoS Attack Mitigation Guide - Fortinet

Source rate limiting
Source rate limiting
Dynamic filtering
When a limited number of sources are available to a bot-master, he/she can use them
to aggressive send packets. These high rate packets can burden the server. Multithreaded
attacks cause such patterns of attack. By identifying outlier IP addresses that
break norms, you can deny them access to excessive bandwidth. Since IP addresses
in such attacks are not predictable, it is important to keep track of millions of IP
addresses and their behavior to isolate outliers. Such isolation can only be done in
silicon and it is difficult to achieve using software only techniques due to excessive
memory bandwidth requirements.
Static filtering is a common technique in firewalls, switches and routers and is usually
achieved using Access Control Lists (ACLs). Dynamic filtering is required when the
attack and the attackers change constantly. Dynamic filtering is done by identifying
undisciplined behavior and punishing that behavior for a short time by creating a shortspan
filtering rule and removing that rule after that time-span.
Active verification through legitimate IP address matching
Anomaly recognition
Protocol analysis
While SYN Proxy is a great technique for anti-spoofing, every time there is a SYN flood,
within a short duration, if the appliance keeps sending SYN/ACK packets back, that
would add too much outbound traffic. To avoid such reverse flood, it is necessary to
cache identified legitimate IPs in to a memory table for a limited period of time and
then letting them go without the SYN proxy check. It is quite possible for the attackers
to misuse such holes, therefore it is necessary to have further checks on legitimate IP
addresses by rate limiting zombies which are able to complete 3-way-handshakes.
Most DDoS attacks are written using scripts which continuously vary a few parameters
in the network packets. By performing anomaly checks on headers, state and rate, an
appliance can filter out most attack packets which otherwise would pass simple
firewall rules.
Similar to header, state and rate anomalies, further protocol analysis can bring out
issues that would otherwise pass through a generic firewall.
FortiDDoS DDoS Attack Mitigation Guide
28-100-167076-20120501 13
http://docs.fortinet.com/ • Feedback