DOCSLIB.ORG

Stellar: Network Attack Mitigation Using Advanced Blackholing

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Stellar: Network Attack Mitigation Using Advanced Blackholing Christoph Dietzel, Matthias Wichtlhuber, Georgios Smaragdakis, Anja Feldmann Stellar: Network Attack Mitigation using Advanced Blackholing Conference paper | Accepted manuscript (Postprint) This version is available at https://doi.org/10.14279/depositonce-9380 © ACM 2018. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies - CoNEXT ’18, http://dx.doi.org/10.1145/3281411.3281413. Dietzel, C., Smaragdakis, G., Wichtlhuber, M., & Feldmann, A. (2018). Stellar: Network Attack Mitigation using Advanced Blackholing. Proceedings of the 14th International Conference on Emerging Networking EXperiments and Technologies - CoNEXT ’18. Presented at the the 14th International Conference. https:// doi.org/10.1145/3281411.3281413 Terms of Use Copyright applies. A non-exclusive, non-transferable and limited right to use is granted. This document is intended solely for personal, non-commercial use. Stellar: Network Attack Mitigation using Advanced Blackholing Christoph Dietzel Matthias Wichtlhuber TU Berlin/DE-CIX DE-CIX [email protected] [email protected] Georgios Smaragdakis Anja Feldmann TU Berlin Max Planck Institute for Informatics [email protected] [email protected] ABSTRACT DDoS threats are continuously increasing in terms of volume, fre- Network attacks, including Distributed Denial-of-Service (DDoS), quency, and complexity. While the largest observed and publicly re- continuously increase in terms of bandwidth along with damage ported attacks were between 50 to 200 Gbps before 2015 [59, 60, 70], (recent attacks exceed 1:7 Tbps) and have a devastating impact on current peaks are an order of magnitude higher and exceeded 1 the targeted companies/governments. Over the years, mitigation Tbps [9, 48] in 2016, and 1:7 Tbps [57] in early 2018. We also ob- techniques, ranging from blackholing to policy-based filtering at serve a massive rise in the number of DDoS attacks. Jonker et routers, and on to traffic scrubbing, have been added to the network al. [41] report that a third of all active /24 networks were targeted operator’s toolbox. Even though these mitigation techniques pro- by DDoS attacks between 2016 and 2017. Similar observations are vide some protection, they either yield severe collateral damage, e.g., reported by the security industry [3, 19]. A particularly prominent dropping legitimate traffic (blackholing), are cost-intensive, ordo DDoS attack type is amplification attacks [64, 65]. They take advan- not scale well for Tbps level attacks (ACL filtering, traffic scrubbing), tage of protocol design flaws, whereby a relatively small request or require cooperation and sharing of resources (Flowspec). triggers a significantly larger response. With a spoofed source IP In this paper, we propose Advanced Blackholing and its system address [49] the response traffic is amplified and reflected tothe realization Stellar. Advanced blackholing builds upon the scalability target. Vulnerable protocols include classical protocols such as NTP, of blackholing while limiting collateral damage by increasing its DNS, and/or SNMP [20, 64], as well as relatively new protocols, e.g., granularity. Moreover, Stellar reduces the required level of coopera- DNSSEC [74] and memcached [5, 57]. Amplification factors of up tion to enhance mitigation effectiveness. We show that fine-grained to 50; 000× have been witnessed in the wild [73]. To exemplify, a blackholing can be realized, e.g., at a major IXP, by combining request of 15 bytes can trigger a 750 Kbytes response. available hardware filters with novel signaling mechanisms. We evaluate the scalability and performance of Stellar at a large IXP 1.1 DDoS Mitigation: State of the Art that interconnects more than 800 networks, exchanges more than This alarming increase in DDoS attacks and their sophistication 6 Tbps traffic, and witnesses many network attacks every day. Our and severity, e.g., see [56, 77], demands scalable yet cost-effective results show that network attacks, e.g., DDoS amplification attacks, countermeasures. However, at this point, we are left with various can be successfully mitigated while the networks and services under mitigation techniques and tools that can partially counteract the attack continue to operate untroubled. impact of the attacks. These include: (i) Traffic Scrubbing Services KEYWORDS (TSS), (ii) Router Access Control List Filters (ACL), (iii) Remotely Triggered Black Hole (RTBH), and (iv) BGP Flowspec. BGP; IXP; Blackholing; DDoS Mitigation. Traffic Scrubbing Services (TSS): offer all-round carefree ser- vices to their subscribers. They redirect the traffic of a service to 1 INTRODUCTION specialized hardware either via DNS redirection or BGP delega- The revolution of the digital age fueled by the Internet has attracted tion [43]. There they classify traffic as unwanted or benign and the good but the evil alike. While the threats executed over the In- send the benign “scrubbed” traffic to its original destination or move ternet are multifaceted from a criminalistics perspective, e.g., fraud, the destination to their network [4, 30, 43, 75]. The convenience and data and identity theft, espionage, or cyber terrorism, the dominant fine-grained filtering of TSS comes at significant recurring costs network threat is Denial-of-Service (DoS) attacks [2]. The goal of and requires in-time subscription and setup. Moreover, it currently DoS attacks is to force a service or system to become unavailable has inherent limitations, e.g., per packet or per flow processing for by consuming crucial resources. These resources can be computing deep packet inspection, which can reduce effectiveness [75] and power at the servers or exploitation of application-layer vulnerabil- does not cope with Tbps-level attacks [48]. Moreover, it may reroute ities, i.e., semantic attacks, or network bandwidth, i.e., volumetric traffic and, thus, impose performance penalties, and is vulnerable attacks. To conduct such volumetric attacks, adversaries often use to evasion tactics [42]. Distributed DoS (DDoS). Traffic from numerous distributed sources ACL Filters: are often used by Internet Service Providers (ISPs) is generated and steered towards a target service to make it un- and Internet Exchange Points (IXPs) to overcome specific network available. Once the network links to the target are congested due problems. They deploy policy-based filters that drop unwanted traf- to the DDoS attack, legitimate traffic that traverses the same links fic at their AS border routers. The implementations and capabilities is also affected. depend on the vendor-specific hardware, e.g., ACL rules or QoS 1 classifiers. Such filters can work well if the hardware is homoge- TSS ACL RTBH Flowspec Advanced neous, the network engineers have sufficient expertise, and the filters Blackholing network management system supports the automated deployment Granularity 3 3 7 3 3 of filters. However, such systems typically do not scale well and, Signaling complexity 7 7 7 7 3 Cooperation •• 7 7 3 given that the filtering location is beyond the ingress points ofthe Resource sharing 3 3 3 7 3 network, the bandwidth to a neighbor AS can still be exhausted. Telemetry 3 7 7 • 3 Remotely Triggered Black Hole (RTBH): also referred to as Scalability 7 • 3 3 3 Resources 7 7 3 7 3 BGP Blackholing, is an operational DDoS mitigation technique [16]. Performance 7 3 3 3 3 ASes under attack can signal upstream ISPs [24, 40] or IXPs [22, 50] Reaction time 7 7 3 3 3 to drop traffic to specific IP prefixes. Using BGP to trigger blackhol- Costs 7 • 3 3 3 ing is simple to realize and lowers the entry barrier for ASes, but Table 1: Advanced Blackholing vs. DDoS mitigation solu- limits the level of granularity of the blackhole (to IP prefixes) and tions. 3: advantage, 7: disadvantage, •: neutral. the acceptance of neighboring ASes. Despite substantial growth of blackholing usage (it quadrupled between 2015 and 2017 [33]) 1.2 Advanced Blackholing in a Nutshell that is evidence of its effectiveness to drop large volumes of attack traffic [26], unfortunately, it is coarse-grained. BGP blackholing also In this paper, we propose another approach for attack mitigation, drops legitimate traffic to the prefix under attack and thereby causes called Advanced Blackholing (Advanced BH). Advanced Blackhol- collateral damage. Essentially, this makes the IP prefix partially un- ing does not require trust, cooperation, and sharing of resources reachable. For RTBH to be effective, cooperation between network among networks. It builds upon the excellent scalability of RTBH operators to act upon receiving a blackhole signal (typically, a BGP (to aggressively drop volumetric attack traffic) while incorporating community) is required, see Section 2. Namely, it requires that BGP the good properties of ACLs, Flowspec, and TSS (fine-granular fil- messages for prefixes more specific than /24 in IPv4 are propagated, tering) in a lightweight fashion. Thus, Advanced Blackholing offers thus, networks operators have to set up exceptions for blackholing a new service in between RTBH and TSS and, as we will show, it to accept BGP messages such prefixes, e.g., /32 in IPv4. can be deployed at scale, e.g., at IXPs. BGP Flowspec: the BGP flow specification feature, also referred IXPs offer an ideal deployment location for DDoS traffic mitiga- to as Flowspec, allows the deployment and propagation of more tion as many ISPs use them to exchange traffic, e.g., more than 800 fine-grained filters (compared to RTBH) across AS domain bor- networks and more than 6 Tbps at DE-CIX in Frankfurt or AMS-IX ders, e.g., to mitigate DDoS attacks [18]. Flow specifications can in Amsterdam. Notice that by enabling such a service in one of match a particular flow with a source, destination, layer-4 (L4) these large IXPs, hundreds of member networks (as well as their parameters, packet characteristics such as length and fragment, customers and peer networks) will immediately benefit without and allow to specify a drop rate limit.
Load more

Recommended publications
  • A Black Hole Attack Model for Reactive Ad-Hoc Protocols Christopher W
    Air Force Institute of Technology AFIT Scholar Theses and Dissertations Student Graduate Works 3-22-2012 A Black Hole Attack Model for Reactive Ad-Hoc Protocols Christopher W. Badenhop Follow this and additional works at: https://scholar.afit.edu/etd Part of the Computer Sciences Commons Recommended Citation Badenhop, Christopher W., "A Black Hole Attack Model for Reactive Ad-Hoc Protocols" (2012). Theses and Dissertations. 1077. https://scholar.afit.edu/etd/1077 This Thesis is brought to you for free and open access by the Student Graduate Works at AFIT Scholar. It has been accepted for inclusion in Theses and Dissertations by an authorized administrator of AFIT Scholar. For more information, please contact [email protected]. A BLACK HOLE ATTACK MODEL FOR REACTIVE AD-HOC PROTOCOLS THESIS Christopher W. Badenhop AFIT/GCO/ENG/12-01 DEPARTMENT OF THE AIR FORCE AIR UNIVERSITY AIR FORCE INSTITUTE OF TECHNOLOGY Wright-Patterson Air Force Base, Ohio APPROVED FOR PUBLIC RELEASE; DISTRIBUTION UNLIMITED The views expressed in this Thesis are those of the author and do not reflect the official policy or position of the United States Air Force, Department of Defense, or the United States Government. This material is declared a work of the U.S. Government and is not subject to copyright protection in the United States. AFIT/GCO/ENG/12-01 A BLACK HOLE ATTACK MODEL FOR REACTIVE AD-HOC PROTOCOLS THESIS Presented to the Faculty Department of Electrical & Computer Engineering Graduate School of Engineering and Management Air Force Institute of Technology Air University Air Education and Training Command In Partial Fulfillment of the Requirements for the Degree of Master of Science Christopher W.
    [Show full text]
  • Solution for TCP/IP Flooding
    1 Solution for TCP/IP Flooding (Data Communication and Networking Report ) +Dr. Kiramat Ullah, -Minhaj Ansari, -Yahya Bakhtiar, -Talha Bilal and Zeeshan* *Arid Agriculture University, Rawalpindi, Pakistan - , PIEAS, University Pakistan + Derby University, UK Abstract: TCP stands for transmission control protocol. It was defined by Internet Engineering Task Force (IETF). It is used in establishing and maintaining communication between applications on different computers and provide full duplex acknowledgement and flow control service to upper layer protocol and application. [2][3][4][5] In this report proposes solution for TCP SYN flood. Key Words— TCP (Transmission Control Protocol). SYN (Synchronous), DoS (Denial of Service), DDos (Distributed DoS) I. INTRODUCTION The entire internet protocol suite -- a set of rules and procedures -- is commonly referred to as TCP/IP, though others are included in the suite. TCP/IP specifies how data is exchanged over the internet by providing end-to-end communications that identify how it should be broken into packets, addressed, transmitted, routed and received at the destination. TCP/IP requires little central management, and it is designed to make networks reliable, with the ability to recover automatically from the failure of any device on the network. The two main protocols in the internet protocol suite serve specific functions. TCP defines how applications can create channels of communication across a network. It also manages how a message is assembled into smaller packets before they are then transmitted over the internet and reassembled in the right order at the destination address. IP defines how to address and route each packet to make sure it reaches the right destination.
    [Show full text]
  • NIST Firewall Guide and Policy Recommendations
    Special Publication 800-41 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology John Wack, Ken Cutler, Jamie Pole NIST Special Publication 800-41 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology John Wack, Ken Cutler*, Jamie Pole* C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 *MIS Training Institute January 2002 U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Phillip J. Bond, Under Secretary for Technology National Institute of Standards and Technology Arden L. Bement, Jr., Director ii Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing tech- nical leadership for the Nation’s measurement and standards infrastructure. ITL de- velops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, ad- ministrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach ef- forts in computer security, and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technolog y Special Publication 800-41 Natl. Inst. Stand. Technol. Spec. Publ. 800-41, 75 pages (Jan.
    [Show full text]
  • Chapter 5: Blocking Spammers with DNS Blacklists 63
    Color profile: Generic CMYK printer profile Hacking / Anti-Spam Tool Kit / Wolfe, Scott, Erwin / 3167-x / Chapter 5 Composite Default screen 5 Blocking Spammers with DNS Blacklists 61 P:\010Comp\Hacking\167-x\ch05.vp Monday, February 23, 2004 9:44:07 AM Color profile: Generic CMYK printer profile Hacking / Anti-Spam Tool Kit / Wolfe, Scott, Erwin / 3167-x / Chapter 5 Composite Default screen 62 Anti-Spam Tool Kit n Chapter 4 we introduced you to DNS Blacklists as one of several means for fighting spam. In this chapter, we will look at popular individual DNS Blacklists, explain how Ito implement them on a mail server, and help you decide which list is the best one to use. When referring to DNS Blacklists, the shorthand DNSBL is often used, and that’s how we’ll refer to them throughout this chapter. Before we talk about specific blacklists and how to implement them, we’ll delve into what DNSBLs are and how they work. UNDERSTANDING DNS BLACKLISTS DNSBLs are an integral part of any spam-fighting toolkit. The fact that many, many users on the Internet are updating them means you get the benefit of block- ing a spammer before the first piece of spam even hits you. To understand how DNSBLs help, you need to know the types of DNSBLs available and how they work. Types of DNSBLs Currently, two different types of DNS Blacklists are used: ■ IP-based blacklists ■ Domain-based blacklists The majority of DNSBLs are IP-based, which look at the Internet Protocol (IP) ad- dress of the server sending the mail.
    [Show full text]
  • Milkyway Networks Black Hole Firewall Version 3.01E2, Against the Requirements Specified by the Common Criteria for Information Technology Security Evaluation [COM96]
    Security Target MILKYWAY NETWORKS BLACK HOLE FIREWALL Version 3.01E2 for SPARCstations November 1997 CEPL-5b Milkyway Networks Black Hole Firewall - Security Target v3.01E2 Executive Summary The Communications Security Establishment (CSE) operates the Trusted Product Evaluation Program (TPEP), the goal of which is to provide third-party critical analysis and testing of commercially developed computer security products which might be used by the Government of Canada. One type of computer security product evaluated within the TPEP is the firewall. This TPEP security target documents the results of the CSE evaluation of Milkyway Networks Black Hole Firewall version 3.01E2, against the requirements specified by the Common Criteria for Information Technology Security Evaluation [COM96]. Details of Black Hole, in terms of its architecture, features, and evaluated configuration, can be found in the document entitled Final Evaluation Report for Milkyway Networks Black Hole Firewall Version 3.01E2 for SPARCstations [CSE97a]. Black Hole is designed to protect resources on an internal (private) network from users on an external (public) network. Access through the firewall is mediated on the basis of rules defined by the administrator, who defines the firewall’s users, services, and rules. Black Hole includes support for user identification and authentication. It also supports host-to-host connection restrictions of: common Internet services (such as Telnet, File Transfer Protocol [FTP], HyperText Transfer Protocol [HTTP], and Gopher); the connection-oriented Transmission Control Protocol (TCP) service; and the connectionless User Datagram Protocol (UDP) service. Black Hole-protected networks can also communicate with one another through the use of a virtual private network (VPN), which establishes an encrypted channel through the external network.
    [Show full text]
  • Security Problems in the TCP/IP Protocol Suite S.M
    Security Problems in the TCP/IP Protocol Suite S.M. Bellovin* [email protected] AT&T Bell Laboratories Murray Hill, New Jersey 07974 ABSTRACT The TCP/IP protocol suite, which is very widely used today, was developed under the sponsorship of the Department of Defense. Despite that, there are a number of serious security flaws inherent in the protocols, regardless of the correctness of any implementations. We describe a variety of attacks based on these flaws, including sequence number spoofing, routing attacks, source address spoofing, and authentication attacks. We also present defenses against these attacks, and conclude with a discussion of broad-spectrum defenses such as encryption. 1. INTRODUCTION The TCP/IP protocol suite[1][2], which is very widely used today, was developed under the sponsorship of the Department of Defense. Despite that, there are a number of serious security flaws inherent in the protocols. Some of these flaws exist because hosts rely on IP source address for authentication; the Berkeley ‘‘r-utilities’’[3] are a notable example. Others exist because network control mechanisms, and in particular routing protocols, have minimal or non-existent authentication. When describing such attacks, our basic assumption is that the attacker has more or less complete control over some machine connected to the Internet. This may be due to flaws in that machine’s own protection mechanisms, or it may be because that machine is a microcomputer, and inherently unprotected. Indeed, the attacker may even be a rogue system administrator. 1.1 Exclusions We are not concerned with flaws in particular implementations of the protocols, such as those used by the Internet ‘‘worm’’[4][5][6].
    [Show full text]
  • Detecting Spammers with SNARE: Spatio-Temporal Network-Level Automatic Reputation Engine
    Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine Shuang Hao, Nadeem Ahmed Syed, Nick Feamster, Alexander G. Gray, Sven Krasser ∗ College of Computing, Georgia Tech ∗McAfee, Inc. {shao, nadeem, feamster, agray}@cc.gatech.edu, [email protected] Abstract can block certain types of unwanted email messages, but they can be brittle and evadable, and they require ana- Users and network administrators need ways to filter lyzing the contents of email messages, which can be ex- email messages based primarily on the reputation of pensive. Hence, spam filters also rely on sender repu- the sender. Unfortunately, conventional mechanisms for tation to filter messages; the idea is that a mail server sender reputation—notably, IP blacklists—are cumber- may be able to reject a message purely based on the rep- some to maintain and evadable. This paper investigates utation of the sender, rather than the message contents. ways to infer the reputation of an email sender based DNS-based blacklists (DNSBLs) such as Spamhaus [7] solely on network-level features, without looking at the maintain lists of IP addresses that are known to send contents of a message. First, we study first-order prop- spam. Unfortunately, these blacklists can be both in- erties of network-level features that may help distinguish complete and slow-to-respond to new spammers [32]. spammers from legitimate senders. We examine features This unresponsiveness will only become more serious that can be ascertained without ever looking at a packet’s as both botnets and BGP route hijacking make it easier contents, such as the distance in IP space to other email for spammers to dynamically obtain new, unlisted IP ad- senders or the geographic distance between sender and dresses [33, 34].
    [Show full text]
  • Stellar: Network Attack Mitigation Using Advanced Blackholing
    Stellar: Network Attack Mitigation using Advanced Blackholing Christoph Dietzel Matthias Wichtlhuber TU Berlin/DE-CIX DE-CIX [email protected] [email protected] Georgios Smaragdakis Anja Feldmann TU Berlin Max Planck Institute for Informatics [email protected] [email protected] ABSTRACT is generated and steered towards a target service to make it un- Network attacks, including Distributed Denial-of-Service (DDoS), available. Once the network links to the target are congested due continuously increase in terms of bandwidth along with damage to the DDoS attack, legitimate traffic that traverses the same links (recent attacks exceed 1:7 Tbps) and have a devastating impact on is also affected. the targeted companies/governments. Over the years, mitigation DDoS threats are continuously increasing in terms of volume, fre- techniques, ranging from blackholing to policy-based filtering at quency, and complexity. While the largest observed and publicly re- routers, and on to traffic scrubbing, have been added to the network ported attacks were between 50 to 200 Gbps before 2015 [59, 60, 70], operator’s toolbox. Even though these mitigation techniques pro- current peaks are an order of magnitude higher and exceeded 1 vide some protection, they either yield severe collateral damage, e.g., Tbps [9, 48] in 2016, and 1:7 Tbps [57] in early 2018. We also ob- dropping legitimate traffic (blackholing), are cost-intensive, ordo serve a massive rise in the number of DDoS attacks. Jonker et not scale well for Tbps level attacks (ACL filtering, traffic scrubbing), al. [41] report that a third of all active /24 networks were targeted or require cooperation and sharing of resources (Flowspec).
    [Show full text]
  • A Look Back at “Security Problems in the TCP/IP Protocol Suite”
    A Look Back at “Security Problems in the TCP/IP Protocol Suite” Steven M. Bellovin AT&T Labs—Research [email protected] 1 Abstract 1 2 of the first three pieces of Ethernet ca- ble in all of AT&T, then a giant monopoly tele- About fifteen years ago, I wrote a paper on security prob- phone company. My lab had one cable, an- lems in the TCP/IP protocol suite, In particular, I focused on other lab had a second, and a “backbone” protocol-level issues, rather than implementation flaws. It linked the two labs. That backbone grew, as is instructive to look back at that paper, to see where my fo- other labs connected to it. Eventually, we cus and my predictions were accurate, where I was wrong, scrounged funds to set up links to other Bell and where dangers have yet to happen. This is a reprint of Labs locations; we called the resuling net- the original paper, with added commentary. work the “Bell Labs Internet” or the “R&D In- ternet”, the neologism “Intranet” not having been invented. Dedicated routers were rare then; we gen- 1. Introduction erally stuck a second Ethernet board into a VAX or a Sun and used it to do the routing. The paper “Security Problems in the This mean that the routing software (we used TCP/IP Protocol Suite” was originally pub- Berkeley's routed) was accessible to system lished in Computer Communication Re- administrators. And when things broke, we view, Vol. 19, No. 2, in April, 1989. It was a often discovered that it was a routing prob- protocol-level analysis; I intentionally did not lem: someone had misconfigured their ma- consider implementation or operational is- chine.
    [Show full text]
  • Blackholing VS. Sinkholing: a Comparative Analysis
    International Journal of Innovative Technology and Exploring Engineering (IJITEE) ISSN: 2278-3075,Volume-8, Issue-7C2, May 2019 Blackholing VS. Sinkholing: a Comparative Analysis Anjali B Kaimal, Aravind Unnikrishnan, Leena Vishnu Namboothiri ABSTRACT--- Distributed denial of service attack has caused routes the malicious traffic to another working IP address major security problems all over the world. Be it small systems, or which checks the packets to find the faulty one. The large organizations, DDoS attack can have severe impact on their following section describes in detail the working of functioning. It is a method used by the attacker to suspend services blackholing and sinkholing methods. to that system for a period of time so that legitimate users cannot access services. Many techniques have been developed to reduce the effect of DDoS attack on the system. In this paper, we study 2. BLACKHOLING about two different methods used to detect and prevent DDoS [3]It is a mitigation strategy for DDOS attacks. Here, the attacks: Blackholing and Sinkholing. The purpose of this study is network traffic is directed into a “black hole” and these to identify when to use blackholing and when to use sinkholing. packets are lost/dropped. A black hole is a place where Keyword:Blackholing, Sinkholing, DOS, DDoS packets are destroyed or dropped and no information about the dropped packets is sent back to the source i.e we create 1. INTRODUCTION [7] [1] an IP route that leads to nowhere. This means that the Whenever a legitimate user is denied access to resources packets are sent to a router that is disconnected and thus all and services, we say denial of service occurs and it is termed the packets sent to it will be lost.
    [Show full text]
  • Network Models
    The OSI Standard Model of ISO Figure 2.3 The interaction between layers in the OSI model 2.7 Figure 2.4 An exchange using the OSI model 2.8 -- 7 layers proto stack, with 7 corresponding protocols. -- Peer to peer processes at each layer in different machines. -- What is a "layer"? What is a layer's "protocol"? --Why do we need the OSI stack of layered protocols, i.e., Network Software? 1) Physical Layer: PDU N/A, bit stream. Figure 2.5 Physical layer 2.10 ** The Physical Layer moves bit sequence over a physical link. ** Links/Media high quality/reliability play a major factor of the design complexity of upper layers' protocols, some layers might be significantly reduced or even finished. Defines the following: a) Physical characteristics of EIA (Electronic Industries Alliances) 422/485 balanced mode interfaces and medium. b) Bit representation: encoding/decoding, electrical/optical. c) Data rate: (b/s) bit TX duration. d) Bits synch: sender and receiver clock synch and same data rate. e) Line configuration: Point-to-point, Multipoint f) Physical Topology: Mesh, ring, bus, and hybrid. g) Transfer mode: Simplex, F/D, and H/D. h) Physical Media: Coaxial, TP, Fiber, Wireless. 2) Data Link Layer: PDU frame with header/trailer , Address Physical MAC address Figure 2.6 Data link layer 2.12 Two Sublayers: 1) Logic Link Control (LLC): **Source-Destination DL-PDUs (frames) delivery. a. Framing/Deframing. b. Physical Addressing: Sender/receiver addresses in the frame header. c. Flow Control: To prevent fast sender from flooding a slower receiver with frames.
    [Show full text]
  • Ethernet Storage Design Considerations and Best Practices for Clustered Data ONTAP Configurations
    , Technical Report Ethernet Storage Design Considerations and Best Practices for Clustered Data ONTAP Configurations Kris Lippe, NetApp January 2016 | TR-4182-0216 Abstract This technical report describes the implementation of NetApp® clustered Data ONTAP® network configurations. It provides common clustered Data ONTAP network deployment scenarios and recommends networking best practices as they pertain to a clustered Data ONTAP environment. A thorough understanding of the networking components of a clustered Data ONTAP environment is vital to successful implementations. This report should be used as a reference guide only. It is not a replacement for product documentation, specific clustered Data ONTAP technical reports, end-to-end clustered Data ONTAP operational recommendations, or cluster planning guides. In addition, any solution- specific guides will supersede the information that is contained in this document, so you should double-check all related references. Data Classification Public, NetApp internal and external. Ethernet1 Storage Best Practices for Clustered Data ONTAP Configurations Version History Version Date Document Version History Version 1.2 January 2016 Added troubleshooting section for Path MTU black-hole detection and updated guidance for flow control settings Version 1.1 June 2015 Updates for 8.3.1, which include enhancements to IPspaces, broadcast domains, and SVM management Version 1.0 March 2015 Mike Worthen: Initial commit TABLE OF CONTENTS 1 Overview ..............................................................................................................................................
    [Show full text]