[j-nsp] DDoS filters

[Steve Holman]

Hi Jonas,

Have you checked out these papers?  Perhaps, they could help some.

Minimizing the Effects of DoS Attacks
http://www.juniper.net/solutions/literature/app_note/350001.pdf

JUNOS Router Security
http://www.juniper.net/solutions/literature/app_note/350013.pdf

Cheers,
Steve

> -----Original Message-----
> From: juniper-nsp-bounces at puck.nether.net 
> [mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of 
> Jonas Frey (Probe Networks)
> Sent: Sunday, March 28, 2004 4:57 PM
> To: juniper-nsp at puck.nether.net
> Subject: [j-nsp] DDoS filters
> 
> 
> Hi all,
> 
> i am looking for a way to filter DDoS targeted at customers. 
> Something like to set a policy to not accept (drop) anymore 
> connections (syns and maybe icmp traffic) to a specific 
> ip/netblock if a limit is exceeded. 
> This of course will break new (tcp) connections but the old 
> ones should remain active which is pretty important.
> 
> Regarding a udp DDoS attack i am not sure what could be done 
> to limit the impact of this.
> 
> Does anyone here have any filters like this in place or deals 
> with alot of DDoS attacks daily and has some technique and 
> knowledge he wants to share (maybe off-list)?
> 
> Regards,
> Jonas
> 
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net 
> http://puck.nether.net/mailman/listinfo/junipe> r-nsp
>