Real-time DDoS mitigation using BGP RTBH and FlowSpec and
Pushing BGP Flowspec rules to multiple routers describe how to deploy the
ddos-protect application. This article focuses on how to monitor DDoS activity and control actions.
The diagram shows the elements of the solution. Routers stream standard
sFlow telemetry to an instance of the
sFlow-RT real-time analytics engine running the
ddos-protect application. The instant a DDoS attack is detected, RTBH and / or Flowspec actions are pushed via BGP to the routers to mitigate the attack. Key metrics are published using the
Prometheus exporter format over HTTP and events are sent using the standard
syslog protocol.
The
sFlow-RT DDoS Protect dashboard, shown above, makes use of the
Prometheus time series database and the
Grafana metrics visualization tool to track DDoS attack mitigation actions.
The
sFlow-RT Countries and Networks dashboard, shown above, breaks down traffic by origin network and country to provide an indication of the source of attacks.
Flow metrics with Prometheus and Grafana describes how to build additional dashboards to provide additional insight into network traffic.
In this example,
syslog events are directed to an
Elasticsearch, Logstash, and Kibana (ELK) stack where they are archived, queried, and analyzed. Grafana can be used to query Elasticsearch to incorporate event data in dashboards. The Grafana dashboard example above trends DDoS events and displays key information in a table below.
The tools demonstrated in this article are not the only ones that can be used. If you already have monitoring for your infrastructure then it makes sense to leverage the existing tools rather than stand up a new monitoring system. Syslog events are a standard that are widely supported by on-site (e.g.
Splunk) and cloud based (e.g.
Solarwinds Loggly) SIEM tools. Similarly, the Prometheus metrics export protocol widely supported (e.g.
InfluxDB).
