EEMCS

Home > Publications
Home University of Twente
Education
Research
Prospective Students
Jobs
Publications
Intranet (internal)
 
 Nederlands
 Contact
 Search
 Organisation

EEMCS EPrints Service


27391 Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event
Home Policy Brochure Browse Search User Area Contact Help

Moreira Moura, G.C. and de Oliveira Schmidt, R. and Heidemann, J. and de Vries, W.B. and Müller, M. and Wei, Lan and Hesselman, C. (2016) Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event. In: Proceedings of the 2016 ACM on Internet Measurement Conference, IMC 2016, 14-16 Nov 2016, Santa Monica, CA, USA. pp. 255-270. ACM. ISBN 978-1-4503-4526-2

Full text available as:

PDF

1131 Kb

Official URL: http://dx.doi.org/10.1145/2987443.2987446

Abstract

Distributed Denial-of-Service (DDoS) attacks continue to be a major threat on the Internet today. DDoS attacks overwhelm target services with requests or other traffic, causing requests from legitimate users to be shut out. A common defense against DDoS is to replicate a service in multiple physical locations/sites. If all sites announce a common prefix, BGP will associate users around the Internet with a nearby site, defining the catchment of that site. Anycast defends against DDoS both by increasing aggregate capacity across many sites, and allowing each site's catchment to contain attack traffic, leaving other sites unaffected. IP anycast is widely used by commercial CDNs and for essential infrastructure such as DNS, but there is little evaluation of anycast under stress. This paper provides the first evaluation of several IP anycast services under stress with public data. Our subject is the Internet's Root Domain Name Service, made up of 13 independently designed services ("letters", 11 with IP anycast) running at more than 500 sites. Many of these services were stressed by sustained traffic at 100× normal load on Nov. 30 and Dec. 1, 2015. We use public data for most of our analysis to examine how different services respond to stress, and identify two policies: sites may absorb attack traffic, containing the damage but reducing service to some users, or they may withdraw routes to shift both good and bad traffic to other sites. We study how these deployment policies resulted in different levels of service to different users during the events. We also show evidence of collateral damage on other services located near the attacks.

Item Type:Conference or Workshop Paper (Full Paper, Talk)
Research Group:EWI-DACS: Design and Analysis of Communication Systems
Research Program:CTIT-General
Research Project:SAND: Self-managing Anycast Networks For The Dns, DAS: Dns (anycast) Security
ID Code:27391
Status:Published
Deposited On:15 March 2017
Refereed:Yes
International:Yes
More Information:statistics

Export this item as:

To correct this item please ask your editor

Repository Staff Only: edit this item