“Hey, what does this button do?”

1. “Hey, what does this button do?” - or - What NOT To Do During a DDoS Attack Presentation to CERT-Polska November 2001 Rob Thomas, robt@cymru.com Rob Thomas - robt@cymru.com

2. Thrill as Rob babbles about... • Rules for DDoS survival. • A look at a recent DoS attack. • Know, know, or NO! • Fun with providers. • What you can do to help! Rob Thomas - robt@cymru.com

3. First Rule for DDoS Survival: • Don’t panic! • “Shut that box down NOW, mister!” The first idea may be the WORST idea. Rob Thomas - robt@cymru.com

4. Other Rules for DDoS Survival: • Prepare your toolkit before you are DoS’d. • Verify, verify, verify. • Don’t finish what the miscreants started! Rob Thomas - robt@cymru.com

5. Other Rules for DDoS Survival:Prepare your toolkit • Sniffer - hardware and/or software. • Don’t forget the cables! • IADS - Intrusion Attempt Detection System. • WHOIS, dig, NetFlow, MRTG, BGP tables, and your peers in FIRST. No doctor performs surgery without tools. Rob Thomas - robt@cymru.com

6. Other Rules for DDoS Survival:Verify, verify, verify • “Millions of runts on every port! The sniffer says so!” • “The entire Internet is against us!” • “They are attacking TCP port 25!” Proper analysis is CRITICAL. Rob Thomas - robt@cymru.com

7. Other Rules for DDoS Survival:Don’t finish the job the miscreants started! • The beauty and elegance of ACL logging. • SYN Defender - the hammer of DoS! • (Ab)using ndd against the miscreants. The bad guys don’t need our help! Rob Thomas - robt@cymru.com

8. A look at a recent DoS attackDetails • Spoofed legitimate source addresses. • Small packets against an unused port. • Upwards of 195Kpps! Rob Thomas - robt@cymru.com

9. A look at a recent DoS attackGoodness • NetFlow in place to track the source provider and IP addresses. • Sniffer in place to grab packet samples. • Active monitoring of the logs resulted in a quick discovery of the attack. Rob Thomas - robt@cymru.com

10. A look at a recent DoS attackBadness • Upstream provider not contacted or asked to track the true source of the attack. • Alert mechanisms were not well rehearsed. A process is useless if no one knows how to use it. Rob Thomas - robt@cymru.com

11. Know, Know, or NOKnow your topology • Have visual maps readily available, albeit secured. • Know the code levels and feature sets of your mission critical gateways. • Have configurations available off-line. Rob Thomas - robt@cymru.com

12. Know, Know, or NOKnow your technology • What are the actual limits? Test them, document them. • Test new features in a lab first. A misunderstood feature is a bug-in-waiting. Rob Thomas - robt@cymru.com

13. Know, Know, or NONO understanding • TCP send and receive spaces. • The joy of asymmetric data flows. • TCP Intercept, meet FireWall-1. Education and experience count; a decrease in training raises the cost of support. Rob Thomas - robt@cymru.com

14. Know, Know, or NOThe key The key is not to understand the features in a vacuum, but to understand the interactions between the features of disparate technologies. Rob Thomas - robt@cymru.com

15. Fun with providers • Trust everyone, but always cut the cards. • Routing the bogons. • “Why do we pay you again?” Be prepared to assume full responsibility for the defense of your site. Rob Thomas - robt@cymru.com

16. What you can do to help! • Prepare a toolkit and IRT process now. • Be a polite netizen - implement ingress and egress filters. • Anti-bogon. • Anti-spoofing. • Apply for FIRST membership! Rob Thomas - robt@cymru.com

17. Blatant Self Promotion;-) • A new addition to your bookmarks file – http://www.first.org • Articles that will help - http://www.cymru.com/~robt/Docs/Articles/ • Tools that will help - http://www.cymru.com/~robt/Tools/ Feedback is welcome and encouraged! Rob Thomas - robt@cymru.com

18. Any questions? Rob Thomas - robt@cymru.com

19. The number one rule for DDoS survival: Don’t panic! Thank you for your time today! Rob Thomas - robt@cymru.com