Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event (extended)

Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event (extended)

Moura, Giovane C. M. and de O. Schmidt, Ricardo and Heidemann, John and de Vries, Wouter B. and Müller, Moritz and Wei, Lan and Hesselman, Christian
USC/Information Sciences Institute

Giovane C. M. Moura, Ricardo de O. Schmidt, John Heidemann, Wouter B. de Vries, Moritz Müller, Lan Wei and Christian Hesselman 2016. Anycast vs. DDoS: Evaluating the November 2015 Root DNS Event (extended). Technical Report ISI-TR-2016-709b. USC/Information Sciences Institute.

Abstract

Distributed Denial-of-Service (DDoS) attacks continue to be a major threat in the Internet today. DDoS attacks overwhelm target services with requests or other traffic, causing requests from legitimate users to be shut out. A common defense against DDoS is to replicate the service in multiple physical locations or sites. If all sites announce a common IP address, BGP will associate users around the Internet with a nearby site, defining the \emphcatchment of that site. Anycast addresses DDoS both by increasing capacity to the aggregate of many sites, and allowing each catchment to contain attack traffic leaving other sites unaffected. IP anycast is widely used for commercial CDNs and essential infrastructure such as DNS, but there is little evaluation of anycast under stress. This paper provides the \emphfirst evaluation of several anycast services under stress with public data. Our subject is the Internet’s Root Domain Name Service, made up of 13 independently designed services (“letters”, 11 with IP anycast) running at more than 500 sites. Many of these services were stressed by sustained traffic at 100\times normal load on Nov. 30 and Dec. 1, 2015. We use public data for most of our analysis to examine how different services respond to the these events. We see how different anycast deployments respond to stress, and identify two policies: sites may \emphabsorb attack traffic, containing the damage but reducing service to some users, or they may \emphwithdraw routes to shift both good and bad traffic to other sites. We study how these deployments policies result in different levels of service to different users. We also show evidence of \emphcollateral damage on other services located near the attacks.

Reference

@techreport{Moura16a,
  author = {Moura, Giovane C. M. and de O. Schmidt, Ricardo and Heidemann, John and {de Vries}, Wouter B. and M{\"u}ller, Moritz and Wei, Lan and Hesselman, Christian},
  title = {Anycast vs.~{DDoS}: Evaluating the {November}
                    2015 {Root} {DNS} Event (extended)},
  institution = {USC/Information Sciences Institute},
  year = {2016},
  sortdate = {2016-05-18},
  finaldate = {2016-09-12},
  number = {ISI-TR-2016-709b},
  project = {ant, lacrend, lander, retrofuture, researchroot, pinest, nipet},
  jsubject = {network_security},
  month = may,
  location = {johnh: pafile},
  keywords = {anycast, dns, design},
  url = {http://www.isi.edu/%7ejohnh/PAPERS/Moura16a.html},
  pdfurl = {http://www.isi.edu/%7ejohnh/PAPERS/Moura16a.pdf},
  otherurl = {ftp://ftp.isi.edu/isi-pubs/tr-709.pdf},
  myorganization = {USC/Information Sciences Institute},
  copyrightholder = {authors}
}