6

I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping.

So lets say I've identified an attack signature and want to drop these packets.

[Attacker]-------------[Hop]----------[Hop]-------[Hop]------[My Server]

At which stage are the packets dropped if they are configured by me, not accidental packet loss.

If they are dropped at my server, how does this help since the packets have already arrived and therefore have taken up bandwidth. Or is packet dropping just a technique to avoid replys being sent out and therefore the attacker has to wait for a timeout?

Improve this question
2
  • "how does this help since the packets have already arrived and therefore have taken up bandwidth": They have taken up bandwith, but they do NOT have taken noticeable computing resources yet (ie. they have not reached any listening service, not caused any parsing, database request, etc.).
    – WhiteWinterWolf
    Commented Jul 24, 2015 at 21:06
  • This doesn't warrant an answer by itself, but if you're getting the packets at all you've already lost the battle. ISP's will often provide mitigation services so you might see if your ISP offers it. Otherwise, there are upstream devices like Abors' Prevail Cloudflare etc... that you can google.
    – GingerBeard
    Commented Oct 28, 2016 at 18:39

3 Answers 3

Reset to default
2

You're correct that if the packets are reaching your server that the attack has succeeded, mostly. Many businesses will purchase DDOS protection from a company that will drop such packets for you before they reach your precious pipes.

One such company and how the service works, very broadly. https://www.cloudflare.com/overview

Improve this answer
2
  • Thanks for the response, so do these services have a larger infrastructure to handle the attacks? And if I were to drop packets locally, would this still help
    – Sam M
    Commented Jul 24, 2015 at 2:45
  • Yes, these companies have much larger capability to handle such things than nearly any company out there save perhaps Google and the like. Dropping packets at your server, or any network equipment that you own would only serve to help local traffic, anything internet traffic would feel the wrath of the DDOS.
    – GingerBeard
    Commented Jul 24, 2015 at 3:04
1

This is really stating the obvious, but if you're the one configuring packet dropping, the packets will be dropped at wherever you configure them to be dropped. You'd usually have a number of options, such as your gateway router, your firewall, your load balancer, or your server if the server has a host-based firewall.

If they are dropped at my server, how does this help since the packets have already arrived and therefore have taken up bandwidth. Or is packet dropping just a technique to avoid replys being sent out and therefore the attacker has to wait for a timeout?

You are correct in both points - if the attack is purely targeting bandwidth and the attackers have more bandwidth than you do, then dropping packets at the server would be futile. Such an attack can only be mitigated from a place upstream that has more bandwidth than the attackers, such as your ISP or CDN (e.g. Cloudflare). However, not all attacks target bandwidth; some target server processing power or memory in which case dropping packets at or close to the server could help significantly.

Improve this answer
0
1

DDoS attack is launched with the intention of bringing down the services (be it network or DNS, as it happens in the case of recent attack on DYN on 21st October).

So the main task to protect yourself from a DDoS attack is:

  • Identify the attack, means identifying the attack packets and segregate it from the genuine traffic.
  • Dropping the attack traffic at appropriate level (or location)

If they are dropped at my server, how does this help since the packets have already arrived and therefore have taken up bandwidth. Or is packet dropping just a technique to avoid replys being sent out and therefore the attacker has to wait for a timeout?

Where to drop the attack traffic depends on variety of parameters like:

  • How much bandwidth you have? Whether DDoS traffic is choking your network?
    If this is the case, then you have to take help of your ISP to stop the attack traffic at their level and prevent it from reaching to you. If your ISP doesn't provide this solution OR you want to take this solution from experts, then many other companies are providing these solutions.

  • Sufficient Bandwidth but server is getting choked because of DDoS
    If this is the case, then you may drop the traffic in your network also.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .