This is what we do currently, We have bunch of ACL on edge asr1k router like fragments etc because most of attack use fragmentation.
Then we have script running every min which poll data from router edge interface and alert is base on bandwidth and PPS rate. We have nfsen which we will use to find out what kind of ddos it was If ddos fill our uplink then we do null route manually to Blackhole target IP, it kicked out that server but keep happy other server. We heard about BGP Flowspec but not confident how does it work and I think ASR1006 doesn't support it. -- Sent from my iPhone > On Nov 7, 2016, at 9:21 AM, Aaron <[email protected]> wrote: > > Thanks Gert, I read this too.... > > https://ripe71.ripe.net/presentations/42-zendesk-ddos.pdf > > I read that FastNetMon can forward to a scrubbing center... but I don't read > anywhere that FastNetMon or its suite of apps can do the scrubbing. > > Someone let me know if I'm misunderstanding this > > - Aaron > > -----Original Message----- > From: Gert Doering [mailto:[email protected]] > Sent: Monday, November 7, 2016 8:12 AM > To: Aaron <[email protected]> > Cc: 'Pavel Odintsov' <[email protected]>; 'Gert Doering' > <[email protected]>; 'Arie Vayner' <[email protected]>; 'cisco-nsp@pu > ck.nether.net' <[email protected]> > Subject: Re: [c-nsp] DDOS Attacks Mitigation > > Hi, > >> On Mon, Nov 07, 2016 at 08:05:54AM -0600, Aaron wrote: >> Can fastnetmon scrub ? I mean can fastnetmon redirect attack traffic >> through it and scrub out bad and forward the good ? > > http://bfy.tw/8cBj > > gert > -- > USENET is *not* the non-clickable part of WWW! > > //www.muc.de/~gert/ > Gert Doering - Munich, Germany > [email protected] > fax: +49-89-35655025 > [email protected] > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
