Abstract

IP Anycast is used for services such as DNS and Content Delivery Networks to provide the capacity to handle Distributed Denial-of-Service (DDoS) a acks. During a DDoS a ack service operators may wish to redistribute tra c between anycast sites to take advantage of sites with unused or greater capacity. Depending on site tra c and a ack size, operators may instead choose to concentrate a ackers in a few sites to preserve operation in others. Previously service operators have taken these actions during a acks, but how to do so has not been described publicly. is paper meets that need, describing methods to use BGP to shi tra c when under DDoS that can build a “response playbook”. Operators can use this playbook, with our new method to estimate attack size, to respond to a acks. We also explore constraints on responses seen in an anycast deployment.

Date

2020

Authors

A Rizvi, Joao Ceron, Leandro Bertholdo, John Heidemann

Journal

arXiv preprint arXiv:2006.14058