Testing DDoS mitigation software

The recently released open source sflowgen tool is a synthetic sFlow generator intended for testing, demonstrations, dashboards, and attack-detection validation. This article uses sflowgen to test the DDoS Protect application.

The screen capture shows how sflowgen DDoS attack telemetry appears in the DDoS Protect dashboard. Charts in the dashboard show different types of DDoS attack. You can see normal low level background activity below the red horizontal threshold line. DDoS traffic can be seen ramping up on the udp_flood and ip_flood charts and leveling off once the attack reaches maximum intensity. Notice that as soon as the attack traffic crosses the threshold, the Controls chart indicates that a Pending control has been created to mitigate the attack.

The Controls table shows the udp_flood attack against host 10.10.0.42 using port 443 as the attack vector. In this case the control action is set to drop, i.e. use a Remotely Triggered Black Hole (RTBH) as the mitigation action. The pending status indicates that it is waiting for user confirmation before being applied.

The Settings tab has been configured to add a local address group containing the 10.10.0.0/24 and 2001:db8:10::/64 CIDRs used in the default sflowgen examples. In addition the udp_flood attack mitigation setting has been set to drop.

./bin/sflowgen ambient --config examples/ambient.yaml

Starts the ambient background traffic.

./bin/sflowgen attack --config examples/attack-ipv4.yaml

Adds the simulated attack traffic.

DDoS protection quickstart guide provides details on how to configure BGP RTBH / FlowSpec with Arista, Cisco, and Juniper routers. With DDoS Protect set to Automatic mode, mitigation actions occur the instant the attack is detected and the traffic is blocked before the attack fully develops. Fast automated DDoS detection and mitigation is essential to protect against the costly disruption caused by DDoS flood attacks.