Destination Based RTBH
Chirag, this ones for you dude.
Consider the topology below.
PC1 sends a syn flood attack using source IP 192.168.1.1 to PC2 destination address 172.16.1.1.
The network engineer at ZeeNet spots the attack and quickly logs onto the trigger router. He adds a static route to the trigger router which states that the next hop for 172.16.1.1/32 is Null0. This static route is then redistributed into BGP and advertised using iBGP to R1. When the static route is redistributed into iBGP, the route-map attached to the redist static command changes the next hop to 192.0.2.1.
R1 has a static route which states to get to 192.0.2.1 go via the null0 interface.
All traffic destined to 172.16.1.1 is then black holed. You might be thinking, Whats the point of that ie ZeeNet has actually black holed the end user. This is true, but at the same time we have removed a lot of unwanted traffic from the ZeeNet network.
The above is a simple example, imagine a scenario where an attacker uses thousands of machines to generate an attack. This could amount to gigabits worth of attack traffic. ZeeNet need to protect their own infrastructure otherwise a lot more of their users will feel the attack.
Now lets look at how to configure destination based RTBH
No comments yet.