Anycast vs. DDoS: Evaluating Nov. 30. Heidemann, J., Moura, G. C. M., de O. Schmidt, R., , de Vries, W. B., Muller, M., Wei, L., & Hesselman, C. Presentation at DNS-OARC Meeting, October, 2016. Based on the paper [Moura16b]
Anycast vs. DDoS: Evaluating Nov. 30 [link]Paper  abstract   bibtex   
Distributed Denial-of-Service (DDoS) attacks continue to be a major threat in the Internet today. DDoS attacks overwhelm target services with requests or other ``bogus'' traffic, causing requests from legitimate users to be shut out. A common defense against DDoS is to replicate the service in multiple physical locations or sites. If all sites announce a common IP address, BGP will associate users around the Internet with a nearby site, defining the \emphcatchment of that site. Anycast adds resilience against DDoS both by increasing capacity to the aggregate of many sites, and allowing each catchment to contain attack traffic leaving other sites unaffected. IP anycast is widely used for commercial CDNs and essential infrastructure such as DNS, but there is little evaluation of anycast under stress. \newline∈dent This talk will provide a \emphfirst evaluation of several anycast services under stress with public data. Our subject is the Internet's Root Domain Name Service, made up of 13 independently designed services (``letters'', 11 with IP anycast) running at more than 500 sites. Many of these services were stressed by sustained traffic at 100x normal load on Nov. 30 and Dec. 1, 2015. We use public data for most of our analysis to examine how different services respond to the these events. In our analysis we identify two policies by operators: (1) sites may \emphabsorb attack traffic, containing the damage but reducing service to some users, or (2) they may \emphwithdraw routes to shift both legitimate and bogus traffic to other sites. We study how these deployment policies result in different levels of service to different users, during and immediately after the attacks. \newline∈dent We also show evidence of \emphcollateral damage on other services located near the attack targets. The work is based on analysis of DNS response from around 9000 RIPE Atlas vantage points (or ``probes''), agumented by RSSAC-002 reports from 5 root letters and BGP data from BGPmon. We examine DNS performance for each Root Letter, for anycast sites inside specific letters, and for specific servers at one site.
@Misc{Heidemann16c,
	author = 	"John Heidemann and Giovane C. M. Moura and
                  Ricardo de O. Schmidt and and Wouter B. de Vries and
                  Moritz Muller and Lan Wei and Christian Hesselman",
	title = 	"Anycast vs. {DDoS}: Evaluating {Nov.} 30",
	howpublished = "Presentation at DNS-OARC Meeting",
	note = "Based on the paper [Moura16b]",
	month = 	oct,
	year = 	2016,
	address = "Dallas, Texas, USA",
	sortdate = 	"2016-10-16",
	project = "ant, lacrend, retrofuture, researchroot, pinest, nipet",
	jsubject = "network_security",
	jlocation = 	"johnh: pafile",
	keywords = 	"based on [Moura16b]",
	url =		"https://ant.isi.edu/%7ejohnh/PAPERS/Heidemann16b.html",
	pdfurl =	"https://ant.isi.edu/%7ejohnh/PAPERS/Heidemann16b.pdf",
	myorganization =	"USC/Information Sciences Institute",
	copyrightholder = "authors",
	abstract = "
Distributed Denial-of-Service (DDoS) attacks continue to be a major
threat in the Internet today.  DDoS attacks overwhelm target services
with requests or other ``bogus'' traffic, causing requests from legitimate users
to be shut out.  A common defense against DDoS is to replicate the
service in multiple physical locations or sites.  If all sites
announce a common IP address, BGP will associate users around the
Internet with a nearby site, defining the \emph{catchment} of that
site.  Anycast adds resilience against DDoS both by increasing capacity to the
aggregate of many sites, and allowing each catchment to contain attack
traffic leaving other sites unaffected.  IP anycast is widely used for
commercial CDNs and essential infrastructure such as DNS, but there is
little evaluation of anycast under stress. \newline\indent
This talk will provide a \emph{first evaluation of several anycast services
under stress with public data}.  Our subject is the Internet's Root
Domain Name Service, made up of 13 independently designed services
(``letters'', 11 with IP anycast) running at more than 500 sites.
Many of these services were stressed by sustained traffic at 100x
normal load on Nov. 30 and Dec. 1, 2015.  We use public data for most
of our analysis to examine how different services respond to the these
events.  In our analysis we identify two policies by operators:
(1) sites may \emph{absorb} attack traffic,
containing the damage but reducing service to some users, or (2) they may
\emph{withdraw} routes to shift both legitimate and bogus traffic to other sites.
We study how these deployment policies result in different levels of
service to different users, during and immediately after the attacks. \newline\indent
We also show evidence of \emph{collateral damage} on other services located near the attack targets.
The work is based on analysis of DNS response from around 9000 RIPE
Atlas vantage points (or ``probes''), agumented by RSSAC-002 reports
from 5 root letters and BGP data from BGPmon.  We examine DNS
performance for each Root Letter, for anycast sites inside specific
letters, and for specific servers at one site.
",
}
Downloads: 0
About
Documentation
Keywords
Search
Users
Terms and Conditions of Use
Privacy Policy
Sitemap
© BibBase.org 2021