Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour the ICMP pings which take down your circit?

share|improve this question
1  
Null routing is done by BGP announcement and applies to the destination address. It's a technique a hosting provider will use when a DDoS is affecting all of their customers. The target of the DDoS will still be down but at least everyone else will be back up. Maybe you meant something other than "Null routing". –  Ladadadada Jul 30 '13 at 6:18
    
He's referring to setting a static null route on his gateway router that routes the packets nowhere. It's not just for BGP. –  Johnny Jul 30 '13 at 23:39

2 Answers 2

The problem with some kind of DDoS attacks isn't what happens to traffic. The problem is the existence of the traffic itself on the link. At some point, your link will just be too full for your router to be able to handle the requests (dropping or null-routing). You see, it doesn't matter what the server/router/firewall is doing, the hose is just too congested.

enter image description here

You defend against this kind of DDoS either by having more links than your attackers can fill (using big service providers like CloudFlare or Akamai, they take the hit for you) or just take your connection/server down.

share|improve this answer
    
Nice picture analogy. Since many internet connections are asymmetric (i.e. 3mbit down, 1mbit up), there is some minimal value in ignoring unknown traffic to avoid filling your upstream pipe with replies. Though for most DDoS attacks, the situation is just as you pictured it -- so many faucets that your pipe will fill up no matter what you do. –  Johnny Jul 30 '13 at 23:36
    
@Johnny Dropping malicious packets could have a significant impact when the effect on the server's resources is more than the effect on the server's link. As an easy example, if a search query that takes 1s, a DDoS can send thousands of search queries that can make your server busy indifferently and block legitimate requests while consuming minimal traffic. That type of DDoS attacks can be mitigated with dropping packets, the problem here is that there's almost no way to distinguish legitimate requests from malicious requests; they all look the same. –  Adnan Jul 30 '13 at 23:56
    
In his question he asked if it would help to "dont even let traffic route into your firewall unless its approved", so it sounds like he has some way to determine what 'approved' traffic is. Maybe it's a home computer and he knows what sites he wants to communicate with. Or maybe it's a public webserver that's only available to a few IP addresses. –  Johnny Jul 31 '13 at 1:16
    
For some providers, such as I think OVH, firewall rules can be propagated to the global POPs and thus be applied when the packets enter the internal network. In this case, blocking unknown traffic will often help, because at the POP, you have maybe a 150Gbps pipe, while on your server you have 100Mbps. –  user239558 Mar 22 at 21:05

To answer your question, yes, null routes can be added to your router to help mitigate a DoS attack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.