Re: Op USA - DDoS

[Patrick <nanog () haller ws>]

On 2013-04-27 15:25, Eric Williams wrote:
> If anybody has more information, please share as any insight you might have on this topic.

Best Current Practices for targets appear to be:

1) Nag your upstreams to
 a) support RFC4778's automated source filtering
 b) setup an emergency filter for critical packet flows, deny the rest
2) Start detecting and feeding unwanted packets into (1a)
3) Plan what can be distributed out via CDN or other services
4) Run a DDoS fire drill and see what breaks

As attacks will change over time, start working with a security firm to
periodically review, plan, and test your mitigation techniques.


Please critique and enhance,
Patrick