DDoS detection and remediation with Akvorado and Flowspec

https://vincent.bernat.ch/en/blog/2023-akvorado-ddos-flowspec

by glenngillen • 3 years ago

25 6 3 years ago

vincent.bernat.ch

majke• 3 years ago

Vincent Bernat's writings are the best.

On my side, our experience with flowspec was not perfect, although arguably it was 10 years ago:

https://blog.cloudflare.com/todays-outage-post-mortem-82515/

https://blog.cloudflare.com/analysis-of-todays-centurylink-l...

https://blog.cloudflare.com/reflections-on-reflections/

Unfortunately, due to performance and security concerns only a handful of large ISP's allow inter-AS flowspec rules. Still - it's worth a try. Check if your ISP is willing to accept flowspec from your BGP router!

Flowspec as a vocabulary allowing users to deploy rules between Autonomus Systems seem to have failed. It is still super useful, mostly within a single AS, if used carefully.

Instead of focusing on flowspec, at Cloudflare we invested in BPF and XDP. We deploy powerful rules on our Linux servers. The flexibility of programmable BPF is light years ahead of anything traditional routers can deliver. Anyhow: there are many ways of doing detection and mitigation, and there is no one right answer. For us BPF did the trick.

SYN matching https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler...

DNS matching https://blog.cloudflare.com/introducing-the-bpf-tools/

vbernat2• 3 years ago

Thanks for the kind words Majek!

We are a Cisco shop and there are a lot of problems on their side too. Initially, there was a paragraph about that, but Cisco is working on these problems, so I didn't want to cause problems yet.

justsomehnguy2• 3 years ago

Until Akvorado integrates DDoS detection and mitigation

So you would integrate them?

Anyway, Akvorado is a beautiful piece, kudos.

I just need some time to tinker with it...

vbernat2• 3 years ago

Something like outlined in the article should be doable without too much complexity. However, I also need to be able to use the result for AS12322 and I didn't disclose everything in the article. I need to tinker a bit more.

justsomehnguy2• 3 years ago

IMO the most straightforward solution would be to something like:

a) add these 'metric counters' in a little more friendly way than mess with ClickHouse itself (maybe a directory with *.sql to be loaded on the start/file change?)

b) a way to publish them in JSON through the webserver

After that I can just poll the endpoint with a script and do whatever I need with that info.

AFAIR ClickHouse has a built-in REST-like interface, which can be used for that but that means the need to expose ClickHouse itself.

eskaytwo• 3 years ago

This is really nice! Have you looked at using stream processors such as ksql for the ddos detection?

DDoS detection and remediation with Akvorado and Flowspec

Related Stories