Belgian ISP under 250 Gbps DDoS for days on end

Re:Belgian ISP under 250 Gbps DDoS for days on end by AdamJacobMuller on Saturday September 18, 2021 @10:26PM (#28581191)

Many ISPs (better called transit providers in this context) offer a service whereby you announce to them a route (over BGP) with a specific BGP community, sometimes over a special session, sometimes inband with your normal transit sessions and they will blackhole (route to discard, null0, /dev/null) all traffic to that IP. Unlike normal internet announcements these are generally (exclusively with the providers i've worked with) available down to the smallest IP unit (v4/32, v6/64) so you can blackhole an IP which is being attacked without impacting other IPs inside the same subnet.

How do you test it? Very simple. Announce an IP (or a few) as blackhole and test to make sure things don't work (from that IP).

Very simply could setup something to ping something on that provider's infrastructure from that IP and... if it starts to work, alert!

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by kbenson on Sunday September 19, 2021 @01:37AM (#28581968)

To my knowledge there's also ways to integrate network observability tools (like kentik) to automate this to a degree, for those that are big enough or DDOS events are common enough that is useful to do so.

I imagine getting paged because of a DDOS is slightly easier when it's telling you it already null routed a few IPs so the rest of your network isn't screwed and you just have to identify how problematic those specific IPs being out of service is and whether you need to take action or wait for them to get bored.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by cft on Sunday September 19, 2021 @02:04AM (#28582059)

That sort of encourages the attackers, because from their point of view, the attack is succeeding while the IP is being blackholed.

[ Parent | on HN ]

Re:Belgian ISP under 250 Gbps DDoS for days on end by jonathanlydall on Sunday September 19, 2021 @02:29AM (#28582150)

I think it’s more about mitigating collateral damage for cases where only one customer of the ISP is being targeted.

[ Parent | on HN ]