1. Introduction. Overview of Pushback. Architecture of router. Pushback mechanism. Conclusion. Pushback: Remedy for DDoS attack

2. Introduction DDoS attacks – Disturbance to the global internet. How do DDoS attacks occur? Congestion could be caused by flash crowds too. Non malicious www.Olympics.comwww.Olympics.com during 2000 Sydney Olympics. Victim can do nothing to protect itself. Can anything be done inside the network to defend?

3. What is Pushback? Pushback - Defense against DDoS. A mechanism that allows a router to request adjacent upstream routers to limit the rate of traffic. Concept - Aggregate congestion control (ACC). Aggregate - Subset of traffic with identifiable property. Congestion Signature - Set of properties of the aggregate identified as causing problems.

4. DDoS attack in progress R2R3 R4 R5R6 R7 R8 D R1 Red - Bad traffic Green - Good traffic

5. Partial view of a router Match congestion Signature ? Rate Limiter Pushbackd Input Queues Output Queues N Y Update Congestion signature Adjust Local ACC D D pushback P

6. Dropped Packet Report Is sent by the rate-limiter to the Pushback daemon. Output interface Magic Number IP Destination address Input interface Timestamp Packet size Reason

7. How does the Pushback daemon identify an attack and the victim? Algorithm Step1: If (w i > 1.2 * w o ) then attack is in progress. Step2: Dropped packets are grouped according to the longest matching prefix in the routing table. Step3: The prefix with the highest number of dropped packets is the set to be used in step4. Step4: The set in step3 is scanned to find the host to which most of the packets are destined to. Step5: If (w i – w b > 1.2 * w o ) then repeat steps 2 to 5.

8. Pushback Request The Pushback daemon uses a pushback request to tell the upstream links about the prefix to rate- limit. Pushback request is as shown below. Depth of Requesting Node RLS-ID Expiration time Bandwidth Limit Congestion Signature

9. Pushback Response Sends responses downstream. The response is very similar to request as shown here. Depth of Requesting Node Time in effect Bandwidth Used Congestion Signature RLS-ID

10. Conclusion Successfully implemented in the lab under FreeBSD operating system. Deployment becomes complex as it requires lot of resources. Any Questions?