Lakhasly

accidental or deliberate overload without also compromising network performance.
The provision of significant excess network bandwidth and replicated distributed
servers is the usual response, particularly when the overload is anticipated. This is
regularly done for popular sporting sites. However, this response does have a significant
implementation cost.
In general, there are four lines of defense against DDoS attacks [PENG07,
CHAN02]:
• Attack prevention and preemption (before the attack): These mechanisms
enable the victim to endure attack attempts without denying service to legitimate
clients. Techniques include enforcing policies for resource consumption
and providing backup resources available on demand. In addition, prevention
mechanisms modify systems and protocols on the Internet to reduce the
possibility of DDoS attacks.
• Attack detection and filtering (during the attack): These mechanisms attempt
to detect the attack as it begins and respond immediately. This minimizes the
impact of the attack on the target. Detection involves looking for suspicious
patterns of behavior. Response involves filtering out packets likely to be part
of the attack.
• Attack source traceback and identification (during and after the attack): This
is an attempt to identify the source of the attack as a first step in preventing
future attacks. However, this method typically does not yield results fast
enough, if at all, to mitigate an ongoing attack.
• Attack reaction (after the attack): This is an attempt to eliminate or curtail the
effects of an attack.
We discuss the first of these lines of defense in this section and consider the
remaining three in Section 7.7.
A critical component of many DoS attacks is the use of spoofed source
addresses. These either obscure the originating system of direct and distributed DoS
attacks or are used to direct reflected or amplified traffic to the target system. Hence
one of the fundamental, and longest standing, recommendations for defense against
these attacks is to limit the ability of systems to send packets with spoofed source
addresses. RFC 2827, Network Ingress Filtering: Defeating Denial-of-service attacks
which employ IP Source Address Spoofing,8 directly makes this recommendation, as
do SANS, CERT, and many other organizations concerned with network security.
This filtering needs to be done as close to the source as possible, by routers
or gateways knowing the valid address ranges of incoming packets. Typically this is
the ISP providing the network connection for an organization or home user. An ISP
knows which addresses are allocated to all its customers and hence is best placed to
ensure that valid source addresses are used in all packets from its customers. This
type of filtering can be implemented using explicit access control rules in a router to
ensure that the source address on any customer packet is one allocated to the ISP