Evaluation and Deployment of DDoS Mitigation Techniques

Doug Montgomery, Kotikalapudi Sriram ({dougm | ksriram}@nist.gov)

Joint work with Mark Carson and Okhee Kim {carson | okim}@nist.gov

Advanced Network Technologies Division

Information Technology Laboratory

http://www.antd.nist.gov/

8/1/16 DHS DDoSD PI Meeting 1
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 2

http://www.circleid.com/posts/20160720_us_congress_website_recovers_from_a_crippling_3

_day_dns_attack/

http://venturebeat.com/2014/12/30/lizard-squad-launches-ddos-tool-that-letsanyone-take-down-online-services-starting-at-5-99-per-month/

http://www.circleid.com/posts/20160719_average_ddos_attacks_large_en

ough_to_take_most_organizations_down/

http://www.forbes.com/sites/leoking/2014/02/12/bitcoin-hit-by-massiveddos-attack-as-tensions-rise/

All sites are vulnerable.

http://www.computerweekly.com/news/4500272230/DDoS-is-mostcommon-cyber-attack-on-financial-institutions

Attacks are financially motivated.

Attacks hit institutions and infrastructure.

Low barrier to entry for attackers.
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 3

http://www.circleid.com/posts/20160525_d

dos_trends_attack_activity_increases_11

1_percent_year_over_year/

http://www.circleid.com/posts/2

0150827_ddos_for_bitcoin_inc

reasingly_targets_financial_ind

ustry/

• Abor Networks: Worldwide Infrastructure Security Report.

• https://www.arbornetworks.com/images/documents/WISR2016_EN_Web.pdf

• Verisign Distributed Denial of Service Trends Report

• https://www.verisign.com/assets/report-ddos-trends-Q12016.pdf
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 4
Evaluation and Deployment of DDoS Mitigation Techniques

• Advanced Techniques

– Focus of much research 

and development.

– Detection, information sharing, 

rate limiting, distributed trace 

back and packet filtering.

• Source Address Spoofing

– Enabler of reflection attacks.

– Disabler of trace-back techniques.

– Focus on Source Address Validation (SAV).

• SAV Existing Techniques

– Are / why aren’t existing techniques (BCP-38,84) deployed?

– What are operational impacts of deployment &management of SAV? 

– Are existing SAV techniques applicable to modern environments?

8/1/16 DHS DDoSD PI Meeting 5
Evaluation and Deployment of DDoS Mitigation Techniques

• IETF / NANOG / RIPE Deployment Guidance

– BCP38 - Network Ingress Filtering: Defeating Denial of Service 

Attacks which employ IP Source Address Spoofing. 2000. 

• https://tools.ietf.org/html/bcp38

– BCP84 - Ingress Filtering for Multihomed Networks. 2004. 

• https://tools.ietf.org/html/bcp84

• Why Aren’t These Techniques Widely Deployed

– Maybe they are? 

– Much more needs to be known about the source of spoofed traffic, 

where it originates from and how.

– Much more needs to be known about the cost / complexities of 

implementing SAV.

8/1/16 DHS DDoSD PI Meeting 6
Evaluation and Deployment of DDoS Mitigation Techniques

• Access Control Lists

– Only scalable for simple fixed subsets.

• Reverse Path Checks (RPF)

– Leverages dynamic BGP control plane to maintain view of valid sources

– Strict RPF

• SA in the FIB and reachable by the interface that receives the packet.

– Loose RPF

• SA in the FIB and reachable over any interface.

– Feasible RPF

• SA in FIB and was announced over interface that receives the packet.

• Link Level SAV

– IP Source Guard, DHCP Linked mechanism.

• Other Approaches?

– SDX Filter Rules

8/1/16 DHS DDoSD PI Meeting 7
Evaluation and Deployment of DDoS Mitigation Techniques

• BCP38 is only a vision..

– Reality is much more 

complicated.

– Goal: SAV that is

• As strict as possible.

• As close to the source as 

possible.

• Minimize performance impact.

• Minimize management burden.

• Minimize failure scenarios.

• No single answer

– Each scenario is different.

– Each mechanism is different.

– Ingress / egress is different.

– Each platform is different.

8/1/16 DHS DDoSD PI Meeting 8

https://spoofer.caida.org/summary.php
Evaluation and Deployment of DDoS Mitigation Techniques

• Independent Technical Evaluation of SAV

– Quantitatively characterize SAV mechanisms 

• Focus on those in current commercial products.

• Applicability, effectiveness, and operational impacts.

• Different deployment scenarios: enterprise (multi-homed), stub 

ISP, small transit ISP, large transit ISP.

• Characterize complexity to manage filtering, performance 

impact on data plane.

– Focus on SAV at Domain Boundaries

• Other deployment scenarios (subnet, multi-tenant) later.

• Develop workload models of inter-domain SAV.

• SAV Deployment Guidance

8/1/16 DHS DDoSD PI Meeting 9
Evaluation and Deployment of DDoS Mitigation Techniques

• Measurements:

– Set of NIST tools, techniques and data sets that can 

form the basis for repeatable quantitative 

measurements of SAV mechanisms in commercial 

networking products.

– Set of vendor independent characterizations of the 

performance impact, management complexity and 

robustness of SAV filtering mechanisms.

• Deployment Guidance:

– Published NIST technical guidance for the deployment 

of inter-domain SAV filtering.

8/1/16 DHS DDoSD PI Meeting 10
Evaluation and Deployment of DDoS Mitigation Techniques

• Data Plane

– Throughput, latency, jitter, packet loss.

– SAV computational load, power consumption.

• Control Plane

– SAV configuration space / time complexity.

– SAV volatility: rate and volume of change.

• Robustness

– Correctness / completeness of SAV filtering data.

– Risks of incorrect data.

– Threats / vulnerabilities of accidental / malicious 

corruption of data.

8/1/16 DHS DDoSD PI Meeting 11
Evaluation and Deployment of DDoS Mitigation Techniques

• SA Workload Models

– Inter-domain SAV requires 

computing “customer cone” 

of operational ISPs.

– SAV Customer Cone – set of prefixes that describe the set of valid 

source addresses that may exit a given domain.

– Questions of the source, accuracy, security, scale and volatility of 

information used to compute customer cones.

– Develop a set of models representative of stub, simple transit, 

transit and tier 1 ISPs.

– Develop tools to parameterize models from common information 

source.

• See backup slides

8/1/16 DHS DDoSD PI Meeting 12
Evaluation and Deployment of DDoS Mitigation Techniques

SAV Benchmark Methodology 

and 

Performance Measurements

13
Evaluation and Deployment of DDoS Mitigation Techniques

14

Rx

Tx

NP / 

ASIC

TCAM

*RAM

CPU

DRAM

Traffic

Manager

Buffer

DRAM

Rx

Tx

Data Plane

Service Processor

Switch Fabric / 

Interface Line Cards Shared Memory

CPU

*RAM

CPU

*RAM

Control Plane

Processor

• SAV mechanisms are implemented in varying ways across 

router platforms, line cards, and service / control 

processors.

• SAV performance is extremely dependent upon specific 

components, port densities, memory sizes, etc.

• Even with a single hardware configuration, specific loading / 

traffic scenarios can produce vastly different results.
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 15
Evaluation and Deployment of DDoS Mitigation Techniques

Emulab-Based Testbed

ASR1001

BGP DFZ

BGP DFZ

16
Evaluation and Deployment of DDoS Mitigation Techniques

• Poor men can’t test fast routers

– Ixia XGS-12 - $300K

• 4 x 40Ge

• 16 x 10Ge

• 8 x 1Ge

• Collaboration with Router Vendors

– Develop an open source set of test scenarios, metrics, 

and reporting formats for SAV benchmarking.

– NIST will develop test scripts (Ixia / open source) to 

execute tests.

– Vendors execute tests across their product line.

8/1/16 DHS DDoSD PI Meeting 17
Evaluation and Deployment of DDoS Mitigation Techniques

Ixia / Emulab Hybrid Testbed

ASR1001

BGP DFZ

BGP DFZ

18

Ixia Data Plane

Measurements
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 19

• Router Performance Baseline

• Focus on PPS/Mbps forwarding rates.

• Performance impact of uRPF mechanisms? 

• Strict mode; feasible (semi-loose) mode; loose mode

• Impact of of BGP routing table on uRPF?

• Test range of FIB sizes 

• Including those larger than TCAM.

• “Spray” source and destination addresses over varying address ranges.

• Impact of varying % of spoofed packets?

• Cost of SAV filtering of spoofed traffic.

• Impact of varying packet size?
Evaluation and Deployment of DDoS Mitigation Techniques

• Cisco ASR1001

– 5 Gbps ESP throughput

– 4 x 1G ports

– 5Mb TCAM

– 65K IPv4 routes 

8/1/16 DHS DDoSD PI Meeting 20
Evaluation and Deployment of DDoS Mitigation Techniques

21

BGP	

table	

size

Tx	Rate	

(Mbps)

Rx	Rate	

(Mbps)

Loss	

(%)

Rx	(Tx)	

Bandwidth	

utilization	

no	BGP	(static	routes) 0 2636 2636 0.00 83.71%

random	SAs,	fixed	DAs 32,000 2636 2636 0.00 83.71%

random	SAs,	fixed	DAs 64,000 2636 2636 0.00 83.71%

random	SAs,	fixed	DAs 128,000 2636 2636 0.00 83.71%

random	SAs,	fixed	DAs 256,000 2636 2636 0.00 83.71%

• uRPF turned OFF

• IPv4

• Packet size: 74B (plus 20B PHY overhead)

• ACL, QoS, Netflow OFF 
Evaluation and Deployment of DDoS Mitigation Techniques

22

BGP	

table	

size

Tx	Rate	

(Mbps)

Rx	Rate	

(Mbps)

Loss	

(%)

Rx	(Tx)	

Bandwidth	

utilization	

Penalty	

due	to	

uRPF

random	SAs,	fixed	DAs 32,000 2394 2394 0.00 76.03% 9.18%

random	SAs,	fixed	DAs 64,000 2393 2393 0.00 75.99% 9.22%

random	SAs,	fixed	DAs 128,000 2393 2393 0.00 75.99% 9.22%

random	SAs,	fixed	DAs 256,000 2392 2392 0.00 75.96% 9.26%

• uRPF turned ON (strict mode)

• IPv4

• Packet size: 74B (plus 20B PHY overhead)

• ACL, QoS, Netflow OFF
Evaluation and Deployment of DDoS Mitigation Techniques

23

• uRPF turned ON (strict mode)

• IPv4

• Packet size: 46B

• ACL, QoS, Netflow OFF 

Throughput	

rate	(Mpps)

Without	uRPF 5.38

With	uRPF 4.44

%	drop	due	

to	uRPF 17%
Evaluation and Deployment of DDoS Mitigation Techniques

• Based on the measurements done so far:

• Throughput penalty due to uRPF observed! 

• 9% (74B, Ixia setup) to 

• 17% (46B, Emulab) for ASR1001.

• Expected TCAM Caching Effects Not Observed!

• BGP/FIB table size does not seem to impact performance.

• Distribution of source / destination addresses used does not 

seem to effect performance.

• Compare Initial Results with Industry Tests

• Verify we are on the right track before exhaustive tests.

8/1/16 DHS DDoSD PI Meeting 24
Evaluation and Deployment of DDoS Mitigation Techniques

IPv4 Measurements by 

Router Analysis, Inc.

ASR1004 Router with 40 GHz ESP & Load Generated by Ixia box

25

64B packets (minimum size)

IPv4 THROUGHPUT 

PENALTY IPv4	

Throughput	

(MPPS)

Forwarding	

only	(Base	

case) 26.60

Forwarding	

with	uRPF 23.45

Forwarding	

with	ACL 21.77

Forwarding	

with	ACL	&	

uRPF 18.14

NIST plot using data from Router Analysis, Inc.

Ref: http://www.slideshare.net/RouterAnalysis/cisco-asr-1000-series-testing-results-andanalysis
Evaluation and Deployment of DDoS Mitigation Techniques

IPv6 Measurements by 

Router Analysis, Inc.

ASR1004 Router with 40 GHz ESP & Load Generated by Ixia box

26

64B packets (minimum size) IPv6 THROUGHPUT 

PENALTY

IPv6	

Throughput	

(MPPS)

Forwarding	

only	(Base	

case) 21.00

Forwarding	

with	uRPF 17.50

Forwarding	

with	ACL 14.90

Forwarding	

with	ACL	&	

uRPF 11.50

0%

17%

29%

45%

0%

5%

10%

15%

20%

25%

30%

35%

40%

45%

50%

Forwarding

only	(Base

case)

Forwarding

with	uRPF

Forwarding

with	ACL

Forwarding

with	ACL	&

uRPF

Throughput	Penalty	compared	to	

the	base	case	(%)

NIST plot using data from Router Analysis, Inc.

Ref: http://www.slideshare.net/RouterAnalysis/cisco-asr-1000-series-testing-results-andanalysis
Evaluation and Deployment of DDoS Mitigation Techniques

Comparison of IPv4 & IPv6

Measurements by Router Analysis, Inc.

ASR1004 Router with 40 GHz ESP & Load Generated by Ixia box

27

NIST plot using data from Router Analysis, Inc.

Ref: http://www.slideshare.net/RouterAnalysis/cisco-asr-1000-series-testing-results-andanalysis

64B packets (minimum size)
Evaluation and Deployment of DDoS Mitigation Techniques

Cisco Advertised Router Performance 

28

Ref: 

http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-seriesaggregation-services-routers/datasheet-c78-731640.html

ESP	

speed	

(GHz)

Forwarding	

only	

(MPPS)

Forwarding	

plus	ACL,	

uRPF,	QoS	

(MPPS)

Penalty	due	

to	ACL,	

uRPF,	QoS	

(MPPS)

2.5 4 2 50.00%

5 7.5 4 46.67%

10 15 8 46.67%

20 19 6.7 64.74%

36 30 19 36.67%

40 23 10.4 54.78%

100 58 26 55.17%

Cisco	ASR	1000	Series	Routers

ESP = Embedded Services Processor

Packet 

size = 

64B

• Working with assistance from Cisco to fill in missing performance results 

(Forwarding plus uRPF, Forwarding plus ACL).
Evaluation and Deployment of DDoS Mitigation Techniques

• Complete SAV Benchmarks Scripts

– Pure Ixia test environment

• Test Range of Platforms

– Cisco ASR1000

• 5 Gbps throughput / 1G ports / 5Mb TCAM

• 65K IPv4 routes. 

– Cisco ASR1001X

• 20 Gbps throughput / 10 G ports / 80Mb TCAM

• 1M IPv4 routes

– Brocade MLXe-8

• 3.2Tbps throughput / 100G ports

• 1M IPv4 routes

– Software / Virtual Routers

• CloudRouter https://cloudrouter.org/

8/1/16 DHS DDoSD PI Meeting 29
Evaluation and Deployment of DDoS Mitigation Techniques

• NIST Publication

– Methodologies for SAV 

Benchmarking.

– Workload models.

– Metrics for SAV 

Evaluation.

– Open source scripts for 

Ixia driven SAV tests.

• Performance Insight

– Factor into deployment 

guidance.

8/1/16 DHS DDoSD PI Meeting 30
Evaluation and Deployment of DDoS Mitigation Techniques

• Need for detailed guidance

– Within a site.

– Single homed sites.

– Multi homed sites.

– Intra sites / VPNs.

– Could / outsourced services.

– ISP customer, provider, peer, IXP 

connections.

• No single answer

– Each scenario is different.

– Each mechanism is different.

– Ingress / egress is different.

– Each platform is different.

8/1/16 DHS DDoSD PI Meeting 31

https://spoofer.caida.org/summary.php
Evaluation and Deployment of DDoS Mitigation Techniques

Examples of Service Disruption due to uRPF:

• Various multi-homing scenarios: ISP may shy 

away from uRPF due to risk to multi-homed 

customer in case customer is not savvy about 

their announcements.

• PMTUD problem faced at IXP and its clients due 

to uRPF.

8/1/16 DHS DDoSD PI Meeting 32
Evaluation and Deployment of DDoS Mitigation Techniques

Concerns about Multi-homed Customer Service

33

• BCP recommendation: Multi-homed customer AS must announce all its routed 

prefixes or more specifics to each of its transit ISPs and should depref routes by 

prepending as necessary.

Strict uRPF works

Feasible uRPF works

Loose uRPF works

P1 P2

P1 P2

P2(prepended)

P1(prepended)

Site A

x Strict uRPF fails

x Feasible uRPF fails

Loose uRPF works

P1 P2

P1 P2

P1

P2

Assume: Customer wants to engineer traffic for P1 via ISP1 and for P2 via ISP2. 

However, uses addresses from either P1 or P2 in SA fields towards either transit ISP.

ISP1 ISP2

Site A

ISP2 ISP1
Evaluation and Deployment of DDoS Mitigation Techniques

PMTUD Problem Faced by IXP Clients

34

IXP

AS3

AS1

AS2

PMTUD 

message 

"packet too big" 

ICMP message "packet too big" 

ICMP message 

SA is an IXP LAN 

address

(DA is the same 

IXP LAN address) In order for the Path MTU Discovery (PMTUD) to work in the presence 

of uRPF:

• IXP should announce in BGP its own LAN prefix to all clients

• All AS clients at the IXP must install the IXP LAN prefix in their 

routing tables

• All AS clients must not accept the IXP LAN prefix or a more specific 

prefix from other peers 

PMTUD 

message 
Evaluation and Deployment of DDoS Mitigation Techniques

35

AS1

10.1.0.0/22 

(Attack Target)

AS2

AS4

AS6

AS5

AS99

Rtr 2

AS98

Rtr 1

10.1.0.0/21 

(Hijack)

• Attacker compromises multiple routers.

• Hijacks less specific of target’s prefix.

• Feasible Path uRPF filters at AS5, AS6 are deceived

• Attacker can launch DDoS reflection attack.

Spoofed DDoS packets

Spoofed DDoS packets

10.1.0.0/21 

(Hijack)

Reflection/ 

Amplification 

Source

BGP Hijacking Can Subvert SAV
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 36

• NIST Security Guidance

– Addressing both Control and 

Data plane issues.

– Recommendations for BGP 

prefix filtering.

– Recommendations for IP SAV 

filtering.

– Addressing multiple deployment 

scenarios

• Coordination with

– USG TIC architectures

– FedRAMP guidance

– FISMA requirements
Evaluation and Deployment of DDoS Mitigation Techniques

References

37

• M. Luckie, B. Huffaker, A.Dhamdhere, V. Giotsas, and kc claffy, “AS 

Relationships, Customer Cones, and Validation.”

• http://www.caida.org/publications/papers/2013/asrank/asrank.pdf

• Cisco router performance measurements:

• http://www.cisco.com/c/en/us/products/collateral/routers/asr1000-series-aggregation-services-routers/datasheet-c78-

731640.html

• Router Analysis, Inc. router performance measurements:

• http://www.slideshare.net/RouterAnalysis/cisco-asr-1000-seriestesting-results-and-analysis
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 38
Evaluation and Deployment of DDoS Mitigation Techniques

• This research was supported by the Department of Homeland Security 

under the DDoSD program and the NIST Information Technology 

Laboratory under the Internet Infrastructure Protection program.

• Certain commercial equipment, instruments, or materials are identified 

in this paper to foster understanding. Such identification does not imply 

recommendation or endorsement by the National Institute of Standards 

and Technology, nor does it imply that the materials or equipment 

identified are necessarily the best available for the purpose.

• The views and conclusions contained in this document are those of the 

authors, and should not be interpreted as representing the official 

policies, either expressed or implied of the NIST, or the U.S. 

Government.

8/1/16 DHS DDoSD PI Meeting 39
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 40
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 41
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 42
Evaluation and Deployment of DDoS Mitigation Techniques

8/1/16 DHS DDoSD PI Meeting 43

• The number of customer prefixes per customer facing PE 

router will vary, and they all add up to 287,841 (for AS3356) 

Total	#	prefixes	in	Customer	Cone	of	AS3356 287,841

Total	#	prefixes	at	AS3356	but	learned	from	Peers/Providers 282,242

Prefixes	observed	at	Level3	(AS3356)	--	as	viewed	by	Routeviews

Additionally	(for	uRPF),	#	unannounced	/8's	in	the	Internet 57
Evaluation and Deployment of DDoS Mitigation Techniques

Characteristics of 

Customer Cone of Level3 (AS3356)

44

AS	path	

length	

(depth) prefix	count

1 2612

2 67569

3 135516

4 65642

5 18609

6 4156

7 575

8 47

9 3

10 2

Total 294731

Unique 287841

Prefixes ASes

AS	path	

length	

(depth) #ASes

1 1

2 4008

3 18069

4 10797

5 3069

6 1057

7 144

8 17

9 3

10 2

Total 37167

Unique 33415
Evaluation and Deployment of DDoS Mitigation Techniques

Walking the Tiers

45

AS3356 

(Level3)_ AS3257 

(Tinet) 

AS12389

(Rostelecom) 

P

C

C

AS	path	

length	

(depth) prefix	count #ASes

1 2612 1

2 67569 4008

3 135516 18069

4 65642 10797

5 18609 3069

6 4156 1057

7 575 144

8 47 17

9 3 3

10 2 2

Total 294731 37167

Unique 287841 33415

AS	path	

length	

(depth) prefix	count #ASes

1 2931 1

2 1330 412

3 120 46

4 1 1

Total 4382 460

Unique 4382

P p2p

AS	path	

length	

(depth) #Prefixes #ASes

1 299 1

2 26330 1004

3 67877 8405

4 37972 6031

5 8984 2231

6 2935 538

7 297 93

8 66 14

9 3 2

Total 144763 18319 AS22773 Unique 144367 17164

(Cox) 

P2C

P2C

P: provider

C: Customer

p2p: peer to 

peer

AS	path	

length	

(depth) #Prefixes #ASes

1 177 1

2 4262 553

3 4438 1052

4 1734 510

5 1063 201

6 129 35

7 60 8

8 1 1

Total 11864 2361

Unique 11855

AS1273

(CW) 

p2p P2C C

P2C

Only 65 prefixes are seen at AS3356 as 

originated by 12389 ! Why not 177? 
Evaluation and Deployment of DDoS Mitigation Techniques

Range of #Prefixes 

in Customer Cone 

46

10

100

1,000

10,000

100,000

1,000,000

#Prefixes	in	AS's	Customer	Cone

Organization	(#AS	Rank,	AS	Number) NIST plot using CAIDA data
Evaluation and Deployment of DDoS Mitigation Techniques

Range of #ASes

in Customer Cone 

NIST plot using CAIDA data 47

1

10

100

1,000

10,000

100,000

#	ASes	in	AS's	Customer	Cone

Organization	(#AS	Rank,	ASN)
Evaluation and Deployment of DDoS Mitigation Techniques

Distribution of #Prefixes 

Originated by an AS

48
Evaluation and Deployment of DDoS Mitigation Techniques

49

AS6 AS7

AS5 AS4

AS2

AS1

P1*

P2*

7.1.1.1

Random SA àDefeat trace-back / forensics: [SA=4.5.6.7 DA=7.1.1.1]

P5*

AS3
Evaluation and Deployment of DDoS Mitigation Techniques

50

AS6 AS7

AS5 AS4

AS3

AS2

AS1

P1*

P2*

7.1.1.1

WPIS

7.8.9.0

Target = SA àReflection Attack: Query [SA=7.1.1.1 DA=7.8.9.0]

P5*
Evaluation and Deployment of DDoS Mitigation Techniques

51

AS6 AS7

AS5 AS4

AS2

AS1

P1*

P2*

7.1.1.1

P5*

AS3

Ingress filtering to drop packets with invalid source address

Customer 

Cone

[SA=2.2.2.2, DA=7.1.1.1]
Evaluation and Deployment of DDoS Mitigation Techniques

52

AS6 AS7

AS5 AS4

AS2

AS1

P1*

P2*

7.1.1.1

P5*

AS3

SAV complicated by multi-homing, peering, asymmetric routes. 

Customer 

Cone ?

[SA=2.2.2.2, DA=5.1.1.1]