Border Router Blacklist for Fragmented DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Reflective DDoS attacks using UDP packets, such as DNS or NTP, are difficult to block due to fragmented packets lacking UDP header information, leading to potential unfiltered attack packets reaching the target.
Innovation Solution
A control device that instructs border routers to create a black list of transmission-source IP addresses for packets identified as attack packets, allowing only authorized packets to pass through by discarding packets with IP addresses on the black list.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the border router uses stateful inspection function of firewall to block UDP packets, then legitimate UDP packets can be filtered, but fragmented attack packets cannot be blocked because they lack UDP header information
Solution Approach 1:
The border router performs preliminary actions by creating fragmentation state tables before UDP header inspection. When packets are fragmented, the router proactively creates state table entries based on IP header information alone, storing fragmentation context. This preliminary state creation enables subsequent inspection of reassembled packets even when UDP headers are absent in fragments, resolving the contradiction between blocking effectiveness and inspection complexity.
2Reliability
If the border router blocks all reply packets without UDP header information, then fragmented attack packets are blocked, but legitimate fragmented reply packets are also blocked
Solution Approach 1:
The border router implements feedback mechanisms through stateful inspection. It monitors packet flow patterns, tracks fragmentation states in state tables, and uses this feedback to dynamically adjust packet handling decisions. The router compares incoming fragmented packets against established state table entries, allowing legitimate fragmented reply packets that match expected patterns while blocking anomalous attack packets, thus maintaining both security and throughput.
3Measurement precision
If the border router inspects each packet individually for UDP headers, then accurate identification is achieved, but fragmented packets are misidentified as non-UDP packets
Solution Approach 1:
The border router applies the nested doll principle by embedding fragmentation state information within state table structures. Each state table entry contains nested information about packet fragments, including offsets, lengths, and reassembly status. This nested organization allows the router to reconstruct complete packet information from fragmented pieces, recovering UDP header data that would otherwise be lost in individual fragment inspection.
Data Source
AI summary
When an attack is detected, a controller samples an attack-target addressed DNS reply, received by a border router, from each of the border routers. Then, the controller adds the transmission-source IP address of the sampled DNS reply to the black list of the border router. Furthermore, upon reception of any of a target-addressed DNS reply and a target-addressed UDP subsequent fragment from the IP address that is described in the black list, the controller gives a command to the border router to discard the packet. Furthermore, the controller specifies the setting, for each of the border routers, that DNS replies to a DNS request from the target are excluded from discarding.