Skip to main content

Diagnosing DDoS Attacks

Figuring out the exact nature of a DDoS attack requires information. In order for RioRey to assist your network engineers in diagnosing the attack and what the best steps to mitigate it are, there are several common questions that we ask. Gathering this information ahead of time will speed up the process of blocking attacks that aren't already automatically mitigated.

Network Topology​

An understanding of your network topology is crucial. Knowing the physical and logical layout of your network helps us differentiate between devices that might be failing or routing issues that might exacerbate the severity of the attack.

Common things that we ask for:

  • A description or diagram of the physical network. This includes where your RioRey devices are, what devices (specific make and manufacturer) are upstream and downstream of them, and the links used to connect devices.
  • A description or diagram of your logical network. This includes the usage of VLANs or other common traffic protocols such as GRE or MPLS. For those three protocols in particular, we unwrap and examine the innermost layer of traffic for attackers.
  • Any traffic configurations that might be considered non-standard. For example, mirroring traffic incorrectly might cause a copy of traffic before it is filtered to appear elsewhere within your network completely unfiltered, and thus cause the attack to succeed even though it appears it is being filtered by our devices.

Who or What is Under Attack?​

DDoS attacks are rarely random and are generally focused on a specific target. Determining the target helps determine what measures should be used to protect that target.

Questions to answer:

  • Is it a specific IP that appears to be under attack? A subnet?
  • Is the attack targeted at a publicly known address or service, or a private one?
  • What is the type of system under attack? Is it a nameserver? A mail server? A web server? Some other service?

What Evidence Have You Collected?​

In order to answer the question of who or what is under attack, you will already have an indication that something is wrong. This could be information gathered by your network engineers using internal monitoring systems, or calls by your customer base complaining about slow or unavailable services. Providing this evidence will help us assist in identifying the primary target and the vulnerability being exploited by an attacker.

Examples of evidence include:

  • MRTG data.
  • Application logs.
  • Traffic statistics from network routers or switches.
  • Customer experience. An example could be a webpage that normally loads in a half second is now taking 15 seconds or longer.

Packet Captures (PCAP)​

The single most helpful diagnostic tool is a live packet capture of ongoing attack traffic. If you have a RioRey device, we prefer to get a 50k "All packets" capture using our tcpdump utility. The dump should be captured against the specific IP address or addresses you believe are under attack. If you don't have a RioRey device to perform this capture, we prefer a capture from the network device (router or switch) that is the furthest upstream within your network. This capture should also be around 50k packets against the IP(s) under attack.

Indications in RioRey Devices​

Almost all DDoS attacks will be blocked automatically be our devices. For attacks that appear to be unfiltered, there is still usually an indication that something is wrong.

Sample indicators to look for:

  • Addresses listed in the victims summary of a configured zone. If no traffic is dropped, this may be an indicator that the mitigation control for that attack is set to "Monitor" mode.
  • Excessive amounts of traffic compared to recent history, either for all zones on the main dashboard or in the traffic summary for a specific zone.
  • Sudden drops in traffic to configured zones, indicating routing issues that may be caused by network device failures.

Any Other Information​

Sometimes previous history or non-concrete data can provide a clue into the nature of an attack.

  • Has there been a significant history of previous attacks?
  • How long has the current attack been going on?
  • Any anecdotal evidence of other network issues?