<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><br><br><div><div id="SkyDrivePlaceholder"></div>> Date: Sun, 10 Feb 2013 14:47:30 +0400<br>> From: melifaro@FreeBSD.org<br>> To: jim.howlett@outlook.com<br>> CC: bird-users@trubka.network.cz<br>> Subject: Re: BGP/OSPF router security<br>> <br>> On 10.02.2013 03:37, James Howlett wrote:<br>> > Hello all,<br>> Hello.<br>> ><br>> > I have a single FreeBSD/bird router running BGP and OSPF.<br>> > I have two full bgp feeds and some IXP sessions.<br>> > Some of my users are subject to DDoS attacks which basicly kill my router.<br>> > Is there anything I can do to make things better? I was thinking about<br>> > adding a second router and having one full bgp feed per router.<br>> > I was also thinking about joining BGP Blackholing project. But - the<br>> > question remains - what else can I do to survive a ddos, or at least be<br>> > able to react when a ddos occures?<br>> <br>> It depends on kind of attacks you're facing with.<br>> If you're simply getting all your upstream ports getting fully utilized <br>> by attack - you should ask your upstreams for DDoS protection they offer <br>> (e.g. blackhole communities, or other stuff).<br>> <br>> If we're talking about (for example, small packets flood) attack that <br>> "kills" router you probably should take a look on your system to make <br>> sure it is tuned well and there are no complex firewall processing rules.<br>> <br>> There are some guidelines (still WIP) here: <br>> https://wiki.freebsd.org/NetworkPerformanceTuning<br>> <br>> Btw, what amount of traffic (PPS) we are talking about?<br>> <br><br>200k pps . The problem was, that the router started to drop the OSFP related comunication, and all my network went off-line.<br><br>All best,<br>Jim<br><br>> ><br>> > All best,<br>> > Jim<br>> ><br>> <br></div> </div></body>
</html>