How can an ISP with low bandwidth like 50 Gbps handle a DDOS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDOS attacks or are there any other enterprise solutions?

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations):


By blackholing traffic, you discard all traffic towards the target IP address. Typically, ISP's try to use RTBH (remotely triggered blackholing), by which they can ask their upstream networks to discard the traffic, so it won't even reach the destination network. The benefit here is that it will not saturate the ISP's uplinks then. The biggest drawback here is that you do exactly what the attackers want: the target IP address (and thus the services running on it) is offline. However, the rest of the ISP's customers will not suffer from the attack, and the costs are low.

selective blackholing

Instead of blackholing an IP-address for the entire internet, it may be useful to change BGP routing for the targeted address range so that it's only reachable for parts of the internet. This is typically called 'selective blackholing' and is implemented by a number of large carriers. The idea is that many internet services only need to be available in a specific region (typically being a country or continent). For example, using selective blackholing, a Dutch ISP under attack could chose to have it's IP-ranges blackholed for traffic coming from China, while European IP's would be able to reach the targeted address. This technique can work very well if attack traffic is coming from very different sources than regular traffic.


A nicer solution is to use a scrubbing center, usually hosted outside the ISP's network as a service. When under DDoS attack, the ISP redirects traffic for that IP-range to the scrubbing center. The scrubbing center has equipment to filter unwanted traffic, leaving a stream of (mostly) clean traffic which gets routed back to the ISP. Compared to blackholing this is a better solution, since the services on the target IP remain available. The drawback is that most scrubbing centers are commercial, and can cost quite a lot. Also, scrubbing is not always easy, there can be both false positives (wanted traffic being filtered) and false negatives (unwanted traffic not being filtered).

traffic engineering

Within larger networks it's possible to create a "sinkhole" router which only attracts traffic for the IP-range under attack. Traffic towards all other IP-ranges gets routed over other routers. This way, the ISP is able to isolate the DDoS to a certain degree by announcing the targeted IP-range in BGP only on the sinkhole router, while stopping announcement of that IP-range on other routers. Traffic from the internet to that destination will be forced through that router. This may lead to all uplinks of that sinkhole router being saturated, but uplinks on other routers will not be flooded and other IP-ranges will not be affected.

The big drawback here is that the entire range in which the targeted IP is (at least a /24) may suffer from this. This solution is often a last resort.

local filtering

If the ISP has enough capacity on its uplinks (so they won't be saturated), they can implement local filtering. This can be done in a various ways, for example:

  • adding an access list on routers rejecting traffic on characteristics like the source address or destination port. If the number of source IP-addresses in an attack is limited, this can work efficiently
  • implementing traffic rate limiters to reduce the amount of traffic to the target IP-address
  • routing traffic through local scrubbing boxes which filter unwanted traffic
  • implementing BGPFlowspec, which allows routers to implement and exchange filter rules using BGP (for example: 'reject all traffic from IP-address X to IP-address Y protocol UDP source port 123')

content delivery networks and load balancing

Web hosters can use content delivery networks (CDNs) to host their websites. CDNs use global load balancing and thus have enormous amounts of bandwidth and caching server clusters all over the world, making it hard to take down a website completely. If one set of servers goes down due to a DDoS, traffic gets redirected automatically to another cluster. A number of big CDNs also operate as scrubbing service.

On a somewhat smaller scale, local load balancing can be deployed. In that case a pool of servers is available to host a website or webapplication. Traffic gets distributed over servers in that pool by a load balancer, thus increasing the amount of server capacity available, which may help to withstand a DDoS-attack.

Of course, CDNs and load balancing only work for hosting, it doesn't work for access ISP's.

  • 2
    Great answer, I like that RTBH is the first thing you mention. Worth noting that what goes on in scrubbing centers (Like at F5 Silverline) can take up an entire answer in itself. – cremefraiche Aug 24 '16 at 7:36
  • About "sinkhole" this procedure need a special device like a IPS/IDS or anything that can analysis the traffic or can be done manually ? – R1- Aug 24 '16 at 7:43
  • I've added some more details on this. – Teun Vink Aug 24 '16 at 9:12
  • 1
    It's a good answer, but you could also add blocking IPs by ranges or other attributes. An ISP can block all incoming traffic by source if the DDOS attack is from a tight enough region. I see them do this all the time with DDOS from "China". They just block all traffic from that region for a short time. + sides: cheap and easy, - sides: it' only works if the DDOS isn't D enough and the target doesn't have services that should be available in that region. i.e. Mom and Pop US flag store, being attacked by 700 IPs from China. – coteyr Aug 24 '16 at 12:22
  • Thanks for the suggestion, I've added some info on selective blackholing and local filtering. – Teun Vink Aug 24 '16 at 12:53

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.