Among other things, we have to deal with DDoS attacks on our infrastructure. Fortunately, there aren't too many, and we can handle them.
DDoS attacks are becoming more frequent; you can watch them live on Digital Attack Map. Our main aim in defending the network perimeter is to stop an attack on one IP address affecting other members and their services.
By far the most DDoS attacks here target servers running TeamSpeak. Clans in various online games try to gain an advantage by cutting off their opponents' communication server, leaving them unable to coordinate at critical moments.
It sounds like a joke, but children really can pay for a 20 Gbps attack these days. Usually, the attacks come from botnets operated to the east of us, whose services can be ordered against a specific IP address. Such an attack costs around 200 dollars for 24 hours.
We currently have two 10Gbps links at each location to the datacentre, which provides a gigabit to NIX.CZ, half a gigabit to SIX.SK and another half abroad. At the physical layer, though, a 9Gpbs attack can reach us.
The main problem is that such an attack doesn't just affect the targeted IP address: it saturates the whole network. We monitor network conditions in Prague and Brno, so we know immediately when this happens. Here's how an attack looks on our traffic graph:
What happens next depends on the attack's intensity. If we can reach our routers, which is usually possible, we simply add the target IP address to the filters and blackhole it using RTBH. A BGP community tells Master to discard traffic for that address on its side. After a few hours, we remove the filter manually, and things are usually quiet.
If an attack is so intense that we can't even access the router, we ask Master to deal with it directly. They check the situation from their side and block the attack if needed. Fortunately, this isn't necessary very often, usually once every three months. Master generally calls before we've even noticed a problem, though, because their technicians stop the attack themselves. No attack has yet taken down all of Master.
We plan to improve our infrastructure with more powerful routers. We currently use MikroTik CCR1036 routers with 36 cores, which can't cope with some types of attack. A recent SYN flood in particular overloaded conntrack (used for NAT on our internal network) so badly that the routers went down.
We've bought more powerful MikroTik CCR1072 routers with 72 cores and want to place them in front of the current ones as new border routers. They won't run conntrack, forwarding packets without keeping state, and have considerably more processing power. Together, this will help us withstand larger attacks. We also want to export Traffic-Flow statistics to a single server that will analyse them and potentially respond to attacks automatically.
Unfortunately, preventing every attack without an outage is very difficult. Based on other networks' experience, we'd need about 40Gbps of capacity to handle the vast majority of attacks without trouble.