How does an ISP combat Bandwidth Exhaustion / Volume DDoS?

Question

While similar to this question, I'm asking in regards to a traditional ISP environment where you are running your own server center and firewall access lists.

With a Bandwidth Exhaustion attack, the success of the attack is simply a measure of how much bandwidth they have purchased, in comparison to how much the target datacenter has available.

A well orchestrated attack will come from more than one ISP, or even many (DDoS), and the source IP address will be randomized. This makes it more difficult for the receiving ISP to block the traffic prior to reaching the customer's datacenter, and also eliminates simple retaliation as a possible (though undesirable) solution.

• I'd like to know what the procedure is to minimize the success of such an attack, beyond the simple answer of purchasing more bandwidth? I assume identifying the source and blocking the packets can only be accomplished with the ISP, and there's nothing the datacenter owners can do on their end.

• If the attack originates from other ISPs, is it necessary for the originating ISPs to cooperate to stop the attack?

• When the DDoS attack is successfully blocked, is legal action often pursued? I assume the attacker could easily start a new account and run the attacks again otherwise.

• This is a fiber-optic internet connection. At a certain level of bandwidth, do distant attacks become less successful? (assuming a limited number of attack sources)

Answer 1

The answer to your question varies wildly based on ISP. Some ISPs are very capable of handling DDoS attacks upstream, while others do absolutely nothing to stop them. Basically, there are three different ways that an ISP can handle them:

1. Buy extra bandwidth and let any attacks through. The simplest and worst solution.
2. Have simple monitoring systems to detect attacks, and blackhole any traffic headed to the destination IP. This protects the network as a whole but still causes the customer to suffer a DoS.
3. Some form of "scrubbing". This is a process, usually third party, of detecting attacks and beginning packet inspection to try and filter out illegitimate traffic. A vast variety of methods are used, from filtering out traffic from foreign countries to detecting amplification attacks (such as DNS Amplification, as described within this US-CERT article). This is the preferred method that most large providers are switching to, since it allows the customer to stay online.

Of course, no matter what the ISP does they can still only filter traffic on their own network boundary. As is the case in the largest DDoS attacks, the bandwidth going to the ISP itself can be overwhelmed. There is little anyone can do in this situation.

Unfortunately, there is not much that the database users can do on their end. As you say, in a bandwidth exhaustion attack it doesn't matter if the database owner can filter traffic if they can't receive any traffic at all.

As much as we would like for ISPs to cooperate to stop these attacks, many come from foreign countries and from so called "bulletproof hosting" providers that ignore any complaints of misuse.

Legal action can almost never be pursued. Attackers are very good at hiding themselves behind botnets, and it can be very difficult to find even if someone bothers investigating. If they are found, they are often in foreign countries that do not have laws governing these attacks. The ones in more modern countries hide in legally gray areas, by doing things like offering "stresser" services to "test" your website against attacks without bothering to check if you really own the website.

Fiber optic connections do not decrease the attack in any significant way in the same way they do not decrease legitimate traffic.