How DDoS Defense Works

Once an attack is detected, specific techniques filter malicious traffic.

Network-Level Mitigation

IP Allow/Block Lists:

• Whitelist: Always allow trusted IPs
• Blacklist: Block known malicious sources
• Use case: Block attack botnets, allow known partners

Network Threat Intelligence Feeds (NTIF):

• Real-time feeds of malicious IPs
• Automatically updated from global threat intelligence
• Blocks known attack sources proactively

Bogon Filtering:

• Blocks traffic from invalid IP ranges
• Private IPs (RFC 1918), reserved ranges, unallocated space
• Eliminates spoofed source addresses

Anti-Flooding:

• Rate limiting per protocol (TCP/UDP/ICMP)
• Connection limits per source IP
• Prevents resource exhaustion

Traffic Policing:

• Bandwidth caps per source/destination
• Enforces traffic priorities
• Protects against bandwidth saturation

Protocol-Level Mitigation

SYN Cookies:

• Responds to SYN requests without allocating resources
• Only creates connection after full handshake
• Prevents SYN flood attacks

Connection Validation:

• Verifies TCP handshake completion
• Drops half-open connections
• Rate limits connection attempts

Packet Validation:

• Checks packet headers for validity
• Rejects malformed packets
• Blocks fragmentation attacks

FlexFilter (Custom Rules):

• Flexible rule creation for specific threats
• Match on packet characteristics (size, flags, TTL)
• Targeted mitigation for unique attack patterns

Application-Level Mitigation

HTTP/HTTPS Filtering:

• Request rate limiting per IP/session
• URL pattern analysis
• Header validation
• Method filtering (allow only valid HTTP methods)

Challenge-Response Mechanisms:

• JavaScript Challenge: Verify browser can execute JS
• CAPTCHA: Human verification
• Cookie Validation: Ensure session persistence
• Distinguishes bots from legitimate users

Slow Rate Mitigation:

• Detects Slowloris and slow POST attacks
• Connection timeout enforcement
• Minimum data rate requirements

Range Amplification Protection:

• Prevents HTTP range header abuse
• Limits partial content requests
• Blocks resource exhaustion via range attacks

Progressive Challenge/Response:

• Escalating verification levels
• Light challenges for most traffic
• Stronger challenges for suspicious behavior
• Balances security with user experience

DNS-Specific Mitigation

Query Rate Limiting:

• Limits queries per source IP
• Prevents DNS flood attacks

Response Rate Limiting (RRL):

• Controls response volume to prevent amplification
• Protects against using your DNS as amplifier

Domain Filtering:

• Blocks queries for specific domains
• Prevents targeted domain attacks

NXDOMAIN Rate Limiting:

• Limits non-existent domain responses
• Mitigates NXDOMAIN flood attacks

DNS Error Caching:

• Caches NXDOMAIN responses
• Reduces processing for repeated invalid queries

Advanced Mitigation

Zombie Host Rate Limiting:

• Identifies infected botnet devices
• Applies stricter rate limits to suspected zombies
• Allows some traffic (device may be legitimate user)

Geographic Filtering:

• Blocks or rate-limits specific countries/regions
• Use when attacks originate from specific geolocations
• Caution: May impact legitimate international users

Protocol-Specific Filtering:

• Specialized rules for SIP, VoIP, gaming protocols
• Custom mitigation for industry-specific applications

Blackholing (Last Resort):

• Drops all traffic to specific destination
• Used when mitigation capacity exceeded
• Temporary measure to protect broader infrastructure
• Note: Service remains unavailable during blackholing

Mitigation Policy Hierarchy

Policies typically applied in order:

• Whitelist: Always allow trusted sources (partners, APIs)
• Blacklist: Block known malicious sources
• NTIF: Block threat intelligence-identified IPs
• Bogon Filtering: Drop invalid source IPs
• Anti-Flood Rules: Rate limiting by protocol
• FlexFilter: Custom rules for specific threats
• Traffic Policing: Bandwidth management
• Application Rules: HTTP filtering, challenges
• Default Action: Allow remaining legitimate traffic

Key Takeaway: Effective mitigation combines multiple techniques applied in layers. Start with broad filtering, refine with specific rules, finish with surgical application-level protection.

‍