When detecting a DDoS attack, do you just block that with your firewall or do you report it to the source providers?

Question

We are receiving a large load of connections, over 10 million per day, over multiple ports (80, 443, 8080, 8888, and 4072).

This has been going on for 4 days now and it does not look like it is going down.

99.9% of those are blocked at our firewall, a few go to Apache. It is difficult to say how much of our system it uses, I would say less than 3%.

Now, it feels like the attack is not going to stop by itself any time soon. Once you protected your system, do you generally contact the ISPs that "participate" in the attack to ask them to stop the offenders?

The attack encompasses well over 2,000 IP addresses from many different providers. So it looks like a rather daunting task to work on such a large number of people, especially because they generally are suspicious of you rather than the attackers/offenders... (i.e. maybe I'm trying to stop a competitor's business and not a hacker.)

Would there instead be a blacklist place were I can provide all the offending IP addresses?

Answer 1

Its not just like this, you should always report such incidents to abuse mail ids of concerned infrastructure.

Many a times the machines involved in DDoS is not known to the owner of the machine, like for ex :-
1. person hosted DNS server and unknowingly left it open for world (open resolver kind of stuff).
2. machine is under the control of RAT or TROJAN

Informing such incidents will help all of us to overall reduce the impact of DDoS which has gone up to 1 Tbps in the recent past.

Moreover you can contribute to centralised repositories too.

Answer 2

In DDoS attack, most of the traffic (in majority of the cases) is of UDP, which is a connection-less protocol. Connectionless means, anyone can spoof anyone else IP address and can send a packet to you.

For example - I can send a UDP packet towards your server with a source IP of google.com (or from any other IP).

In case, you are receiving a TCP session/traffic on your server (traffic which you are considering as a malicious traffic), then you can collect the complete logs with the proper timestamps and can send the same to the ISP.

I works for one of the large ISP in my region and we generally use to receive lots of unwanted traffic from across the world and we report the same to the originator.

Reporting of abuse traffic is done in below mentioned manner --
Collect the logs of the malicious traffic and send it to the abuse handling team of the corresponding originator IP address. You can easily find out the details of the abuse handling team on Incident Response Team section of the WHOIS data of the originating IP address.

As far as your concern of having lot many IP addresses as the originator of the malicious traffic, there are many open source tool available which can parse the logs, do the whois and can send a mail to the originator. And writing a code for this is also not a big task; it can be done in-house also.

Now comes the last part of your query, about the blacklist place where you can submit these IP addresses; There is no such place, if we talk in plain vanilla language. But what you can do is, you can ask your Upstream provider to block traffic from those IP addresses towards your network (if you want to block those IP addresses for your network). There can be a side-effects of this approach also. so please think before blocking the addresses completely.
Also, you can collaborate with IT security companies for further analysing of the traffic.

Hope this explains the things!!!

Answer 3

Reporting it is quite pointless. The "offenders" are very likely part of a botnet, so they aren't even aware they are part of the attack.

In many jurisdictions, privacy laws forbid ISPs from even looking at the traffic of their customers without a search warrant, so they can not confirm your accusation. And besides, they have better things to do than alienate their paying customers for you.