Roland, I don't know much about BGP level routing etc. so i may be confused. Let me think about it and read what it can do for us. I may send you private email for more details if you don't mind.
On Tue, Apr 26, 2016 at 4:59 PM, Roland Dobbins <[email protected]> wrote: > On 27 Apr 2016, at 3:33, Satish Patel wrote: > >> 1. Does S/RTBH require BGP right? >> 2. To run BGP requirement is you have to be /24 class network right? >> (we are very small company) > > > As I already explained, the BGP triggering mechanism for S/RTBH and for > flowspec (if your platform supports it) has *nothing to do with routing*, it > is simply a control-plane trigger mechanism, in this context. It has > *nothing to do with your upstream transit provider*. You can *do it locally > on your own transit edge router*. > > Read and absorb this .pdf preso: > > <https://app.box.com/s/xznjloitly2apixr5xge> > >> 3. DDoS has many many source IP address (spoofed) It's hard to block > > > You said that you were mainly suffering from UDP reflection/amplification > attacks. As I stated in a previous response in this thread, those sources > are *not* spoofed, from your perspective. Please read and absorb this .pdf > preso: > > <https://app.box.com/s/r7an1moswtc7ce58f8gg> > >> Source when million IP attacks, right? > > > You don't generally see a million IP addresses in UDP > reflection/amplification attacks. The good thing about the combination of > flow telemetry and S/RTBH are a) that you can tabulate the sources and b) > that S/RTBH scales up to the FIB limit of your router. > > I mitigate DDoS attacks for a living, FYI. It might be a good idea to read > and absorb what I write and read and absorb the presos I post and the links > I post, because it sounds as if you can benefit from this information. > > > ----------------------------------- > Roland Dobbins <[email protected]> > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
