FWIW, This is fairly standard.
Linode for example will null-route your linode for 24 hours if it's attacked.
It's quite irritating that hosting companies seem to see null-routing as a solution to a DDoS attack.
Linode for example will null-route your linode for 24 hours if it's attacked.
It's quite irritating that hosting companies seem to see null-routing as a solution to a DDoS attack.
> This is fairly standard.
> It's quite irritating that hosting companies
> seem to see null-routing as a solution to
> a DDoS attack.
Null routing does a good job of mitigating impact to other servers, but obviously causes problems. If there's enough capacity, filtering at the border would probably work. I think most of the attacks these days are DNS reflection (because it's easy and effective), so if the border routers could be configured to drop incoming udp from port 53 to the IP under attack, that would get you most of the way there (just make sure the server under attack doesn't need to get port 53 replies from the internet). That sounds simple, but it has three big problems: a) You need a lot of spare input bandwidth. b) You need to be able to filter on border routers. c) You need to be able to safely change the filters on the border routers.
This would drastically cut down source address spoofing, which is the worst type of DDoS to try to cope with.
Secondly I'd setup a far better method of reporting and blocking traffic up the chain.