DDoS Protect

ip_flood

ip_fragmentation

icmp_flood

udp_flood

udp_amplification

tcp_flood

tcp_amplification

Controls

BGP

Target	Group	Attack	Protocol	Time	Action	Status

Controller Mode

Automatic mode allows the controller to install controls without operator action. Manual mode requires confirmation before controls are installed.

Attack Mitigation

Attack	Action	Threshold	Timeout	Include	Exclude
ip_flood
ip_fragmentation
icmp_flood
udp_flood
udp_amplification
tcp_flood
tcp_amplification

Click on rows in the table to change attack mitigation settings: threshold (in packets per second) to trigger control action, timeout (in Minutes) before removing action, and action type (ignore, drop, filter, mark, limit, redirect, community).

Address Groups

Group	CIDRs

Click on rows in the table to remove group or edit comma separated list of CIDRs.

About

DDoS Protect is a real-time distributed denial of service (DDoS) detection and mitigation application using the sFlow-RT real-time analytics engine. The software receives a continuous stream of telemetry from standard sFlow agents embedded in network devices, detects DDoS attacks, and pushes BGP remote triggered blackhole (RTBH) or Flowspec messages to block the attack upstream.

Getting Started

The following steps are required:

Configure sFlow
Configure BGP
Group address space
Set mitigation policy

Once configuration is complete, the Charts tab will display candidate DDoS traffic. If the charts show zero traffic, verify that sFlow data is being received and that traffic groups are correctly defined. The BGP chart can be used to verify that the BGP connection has been established.

Configure sFlow

Switch configurations contains a repository of links describing how to configure sFlow on different vendor's switches. Use the sFlow-RT Status tab to verify that sFlow telemetry is being received.

Configure BGP

Configure Startup Settings to enable BGP and ensure settings match those that will be configured on router(s). Configure site router(s) (or route reflector) to establish a BGP connection to controller on TCP port 1179. Use the BGP chart under the Charts tab to verify the connection(s).

If the router cannot be configured to connect to the non-standard 1179 BGP port then additional operating system privileges need to be assigned to the sFlow-RT daemon so that port 179 can be opened.

Docker

Using the sflow/ddos-protect image:

docker run --net=host \
-v $PWD/ddos.conf:/sflow-rt/ddos.conf \
sflow/ddos-protect -Dsystem.propertyFiles=ddos.conf -Dbgp.port=179

Systemd

Edit the sflow-rt service

sudo systemctl edit sflow-rt.service

Add the following statements:

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE

Edit the ddos-protect configuration file:

sudo vi /usr/local/sflow-rt/conf.d/ddos-protect.conf

Add the line:

bgp.port=179

Restart sFlow-RT:

sudo systemctl restart sflow-rt.service

Group Address Space

Group	CIDRs
external	0.0.0.0/0, ::/0
private	10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, fc00::/7
multicast	224.0.0.0/4, ff00::/8
exclude	192.0.2.0/24
servers	192.0.2.128/25

The example above lists the public address space allocated to the site in the exclude group, which by default prevents these addresses (along with addresses in the private, multicast, and external groups), from being mitigation candidates. Any additional groups are candidates for mitigation in the case of a DDoS attack, in this case the servers group with CIDR 192.0.2.128/25.

Note At least one candidate group must be defined before traffic will be shown under the Charts tab.

Alternatively, local / non-local address space can be discovered through BGP:

Enable export of BGP data in the sFlow configuration on routers that support the sFlow extended_gateway feature
Otherwise, use the ddos_protect.router.<N>.agent setting to lookup route information from the BGP feed

Once BGP route information is being received, the ddos_protect.bgpgroup=site setting enables classification of traffic based on the learned routes, assigning local addresses to the site group. Excluded groups are honored and additional groups will be used to label traffic, but will not affect determination of site addresses.

Set Mitigation Policy

The following volumetric DDoS attack types can be detected:

Attack	Description
ip_flood	IP packets by target address and protocol
ip_fragmentation	IP fragments by target address and protocol
icmp_flood	ICMP packets by target address and type
udp_flood	UDP packets by target address and destination port
udp_amplification	UDP packets by target address and source port
tcp_flood	TCP packets by target address and destination port
tcp_amplification	TCP SYN-ACK packets by target address and source port

For each attack type, select a mitiation action:

Action	Description
ignore	Ignore, don't create control
drop	Remote triggered black hole (RTBH) dropping all traffic to targetted address
filter	Flowspec rule dropping traffic matching protocol, port and target address
mark	Flowspec rule setting DSCP for traffic matching protocol, port and target address
limit	Flowspec rule rate limitting traffic matching protocol, port and target address
redirect	Flowspec rule redirecting traffic matching protocol, port and target address
community	Flowspec rule setting community for traffic matching protocol, port and target address

For each attack type, set a threshold (in Packets per Second) that will trigger the specified action. Actions are automatically removed after the specified timeout (in Minutes), unless the attack traffic is still above the threshold level.

Set the Controller Mode to Manual if you want to confirm control actions before they installed. Click on a row in the Controls table to manually Remove or Install the control.

Monitoring

Integration is provided with external monitoring systems:

Events are logged every time a new attack is detected. These events can be forwarded using the syslog protocol. Configure ddos_protect.syslog.host to specify a comma separated list of log collector IP addresses.
Metrics are published using the Prometheus export format. Configure metrics database to periodically request current values.

Startup Settings

See System Properties for information on configuring startup settings.

Property	Default	Description
bgp.start	no	Start BGP listener
bgp.port	1179	TCP port used to listen for BGP connections
ddos_protect.router	127.0.0.1	Comma separated list of BGP router IP addresses making connections
ddos_protect.router.<N>.agent		Use Nth (starting at 0) router to lookup BGP routes for comma separated list of agents
ddos_protect.as	65000	Local AS number to advertise to router(s)
ddos_protect.id	0.6.6.6	Local identifier to advertise to router(s)
ddos_protect.community	65535:666	BGP community used to identify blackhole routes
ddos_protect.nexthop	192.0.2.1	BGP next hop used to identify blackhole routes
ddos_protect.nexthop6	100::1	BGP IPv6 next hop used ot identify blackhole routes
ddos_protect.localpref	100	BGP local preference used to identify blackhole routes
ddos_protect.enable.ipv6	no	BGP enable IPv6 addresses
ddos_protect.enable.flowspec	no	BGP enable Flowspec IPv4 rules
ddos_protect.enable.flowspec6	no	BGP enable Flowspec IPv6 rules
ddos_protect.flowspec.dscp	le	BPG Flowspec DSCP value for marking traffic
ddos_protect.flowspec.rate	12500	BGP Flowspec rate (in Bytes per Second) for rate limited traffic
ddos_protect.flowspec.redirect.method	as	BGP Flowspec redirect method: as, as4, ip, nexthop, ipaction
ddos_protect.flowspec.redirect.as	65000:666	BGP Flowspec redirect VRF 2-octet AS, 4-octet value
ddos_protect.flowspec.redirect.as4	65000:666	BGP Flowspec redirect VRF 4-octet AS, 2-octet value
ddos_protect.flowspec.redirect.ip	192.0.2.1:666	BGP Flowspec redirect VRF IPv4 address, 2-octet value
ddos_protect.flowspec.redirect.nexthop	192.0.2.1	BGP Flowspec redirect next-hop for IPv4 flows
ddos_protect.flowspec.redirect.nexthop6	100::1	BGP Flowspec redirect next-hop for IPv6 flows
ddos_protect.flowspec.redirect.ipaction	192.0.2.1	BGP Flowspec redirect IPv4 next-hop action
ddos_protect.flowspec.community	128:6:0	BGP Flowspec community
ddos_protect.maxroutes	1000	Maximum number of blackhole routes allowed
ddos_protect.maxflows	100	Maximum number of Flowspec rules allowed
ddos_protect.externalgroup	external	Address group for external traffic
ddos_protect.excludedgroups	external,private,multicast,exclude	Address groups to exclude as blackhole candidates
ddos_protect.group.<name>		Set default for address group name to comma separated list of CIDRs
ddos_protect.bgpgroup		Set group name for local addresses and use BGP to learn local / non-local CIDRs
ddos_protect.ip_flood.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.ip_flood.threshold	1000000	Default threshold (in Packets per Second)
ddos_protect.ip_flood.timeout	180	Default period to maintain action (in Minutes)
ddos_protect.ip_flood.include		Default list of IP protocols to include, empty list includes all
ddos_protect.ip_flood.exclude		Default list of IP protocols to exclude
ddos_protect.ip_fragmentation.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.ip_fragmentation.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.ip_fragmentation.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.ip_fragmentation.include		Default list of IP protocols to include, empty list includes all
ddos_protect.ip_fragmentation.exclude		Default list of IP protocols to exclude
ddos_protect.icmp_flood.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.icmp_flood.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.icmp_flood.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.icmp_flood.include		Default list of ICMP types to include, empty list includes all
ddos_protect.icmp_flood.exclude		Default list of ICMP types to exclude
ddos_protect.tcp_amplification.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.tcp_amplification.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.tcp_amplification.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.tcp_amplification.include		Default list of TCP ports to include, empty list includes all
ddos_protect.tcp_amplification.exclude		Default list of TCP ports to exclude
ddos_protect.tcp_flood.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.tcp_flood.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.tcp_flood.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.tcp_flood.include		Default list of TCP ports to include, empty list includes all
ddos_protect.tcp_flood.exclude		Default list of TCP ports to exclude
ddos_protect.udp_flood.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.udp_flood.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.udp_flood.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.udp_flood.include		Default list of UDP ports to include, empty list includes all
ddos_protect.udp_flood.exclude		Default list of UDP ports to exclude
ddos_protect.udp_amplification.action	ignore	Default action: ignore, drop, filter, mark, or limit
ddos_protect.udp_amplification.threshold	500000	Default threshold (in Packets per Second)
ddos_protect.udp_amplification.timeout	60	Default period to maintain action (in Minutes)
ddos_protect.udp_amplification.include		Default list of UDP ports to include, empty list includes all
ddos_protect.udp_amplification.exclude		Default list of UDP ports to exclude
ddos_protect.mode	manual	Default mitgation mode: manual or automatic
ddos_protect.flow_seconds	2	Moving average used to smooth flow rates
ddos_protect.threshold_seconds	60	Hold time for threshold before it will re-trigger
ddos_protect.scf	no	Ignore event if there are too few traffic sources
ddos_protect.scf_sources	10	Minimum number of traffic sources required to trigger threshold
ddos_protect.syslog.host		Comma separated list of syslog collector IP addresses
ddos_protect.syslog.port	514	UDP port for syslog events
ddos_protect.syslog.facility	16	Syslog facility, default local0
ddos_protect.syslog.severity	5	Syslog severity, default notice