[AusNOG] DDOS mitigation

[Dobbins, Roland]

On May 10, 2013, at 2:32 PM, James Braunegg wrote:

> Prolexic says Q1 2013 the average attack from last quarter has increased from 5.9Gbps to 48.25Gbps with an average packet per second rate of 32.4 million packets.

I don't know how these stats are calculated nor what scope they represent, but they certainly seem high, IMHO.  There certainly are attacks that large and larger, but they aren't the average, in my experience.  The thing is, attacks in the kpps/mbsec range are generally enough to take down most (not all) targeted organizations, so it's massive overkill, in any event.

I wouldn't presume to speak for Prolexic, however.  Best to ask them directly.

> What's your take on the massive difference between the averages ? 

Prolexic are an overlay MSSP DDoS mitigation service provider who mitigate attacks directly themselves for their end-customers.  We are a vendor of solutions for detecting and mitigating DDoS attacks - we sell things that ISPs/MSSPs/enterprises utilize to defend against DDoS attacks.

The ISPs/MSSPs/enterprises which deploy our solutions can opt-in to provide us anonymized statistics; if they do so, they in turn gain access to the anonymized statistics shared by other organizations.  We also have instrumentation deployed in various ISP networks, and we infiltrate botnet C&Cs, analyze code, and the like in order to understand what the attackers are doing.

So, Prolexic are an MSSP providing a service directly to end-customers , we're a vendor whose products are used by many ISPs/MSSPs to provide services to *their* end-customers, and by end-customers to mitigate attacks against their own properties. 

Again, as to how their stats are calculated, you'll need to ask Prolexic directly.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton