Juniper Networks Customer Presentation

Solutions For Denial of Service (DoS) MinimizationIan QuinnAPRICOT 2001Kuala Lumpur, Malaysia
Juniper Networks, Inc. Copyright 2000 - Proprietary & Confidential

The Impact Of Denial of Service (D0S)Detecting And Minimising DoSSMURF AttacksSYN AttacksInfrastructure RequirementsProactive MeasuresAgenda

Popular Points OfAttack And PressureActual TargetsCustomersDatacentersISP serversInfrastructure (eg routers)
Service Providers &Regional/National backbonesCustomers On Access CircuitsData CenterPeering PointsCore InfrastructureAdditional Pressure PointsAccess circuitsPeering pointsLow bandwidth core links

What Are The Threats To A Service ProviderDisruption Of Customer NetworksDesirable to be able to assist customerConsumption Of BandwidthLower bandwidth links susceptibleOften a big problem in Asia PacificNetwork StabilityFrequently a problem for older platformsRelated to additional workload, and performance headroomAll Affect Service Delivered

Emergence Of DistributedDenial Of Service (DDoS)Targeted largely at serversHarnessed networks of compromised machines

Specific ImpactOf DoS In Asia Pacific
ServiceProvider 1ServiceProvider 2ServiceProvider 3Tier 1ProviderAustraliaNew ZealandUnited StatesDoSAttackDoS AttackTier 1ProviderTier 1Provider

Impacts Of Security IncidentsCustomer service levelsInternet access, web farms, ecommerceEspecially if impact is repeatedSupport overheadEspecially in isolating and blocking Denial of Service (DoS) attacksService provider reputationService Level Agreement (SLA) breachesSLA increasingly being offeredMulti-service networks change the gameSTRESS!!!

Generic Approach To DoS AttacksUse statistics to detect attack in progressUse sampling or logging to capture traffic for analysisIsolate attackAttack typeSource (often difficult or impractical)DestinationBlock or traceback the attack using filtersFilter on destination and protocolsDrop traffic or rate limit

Detecting AttacksSudden changes in traffic profilesAverage packet size changesLink utilisation increasesTraffic by destination address Source address normally forged or distributedGenerate alarms in response to changesAlarm for closer human inspectionOverview easily available for NOC staffMigrate to some level of automated response

Complicating Factors With DoSDistinguishing DoS traffic from normal usageForged source addressMore difficult to isolate and track attackDistributed attacksAttack could enter from multiple pointsDifficult to track back and shut downBlocking attacks that match valid trafficDisruption of normal service

SMURF AttacksThe attacker sends a broadcast ping to an intermediary subnet using a forged source addressThe forged source address belongs to the target of the attackThe result is an over-burdened CPU on the target server and over-utilized access trunks
Intermediary Hosts (Several on Same Subnet)Data ServerAttackers Work Station

Dealing With SMURF AttacksDetection is achievedby using the countaction within firewall filtersThe filtering is achieved by changing the accept to a discardThe log action assists in the tracing
term a { from { destination-address { 10.1.1.0/24; } protocol icmp; } then { count icmp-counter; log; accept; }}term b { then accept;}

Dealing With SMURF AttacksOnce the filter is applied to the interface, you can view the firewall counters If the ICMP counter increments quickly, an attack is underway

Dealing with SMURF AttacksStopping the attack is a matter of changing the accept action to a discardDiscarding all ICMP traffic to the targeted host at the router closest to that host is not most efficientBandwidth resources are still wastedAlso apply this filter at AS boundaries where the targeted host resides

Where Did that SMURF Come From?Finding the bad guy is not easyView show firewall log to see source addresses of ICMP traffic; however, this step identifies only the intermediary, not the attackerContact the owner of the intermediary and ask him toDisable broadcast pingsTrack back the pings to the attacker

SYN AttacksThe attacker sends a stream of SYNs to the server under attack using a forged source addressThe forged source address is unused by anyoneThe result is over-burdened CPU and/or memory exhaustion on the target server and over-utilized access trunks
AttackerDataServer

SYN AttacksDuring a SYN attack, the SYN-ACK never reaches the clientSockets remain open on the serverThe result is over-burdened CPU and/or memory exhaustion on the target server, and over-utilized access trunks
Client ServerSYN--------------------> Correct Three-way Handshake

Dealing With SYN AttacksDetection is achieved by configuring a firewall filter to count TCP versus SYN trafficTracing is achieved by leveraging the sampling capability to derive the incoming interface

Details of the Detection ProcessOnce the filteris applied to the interface, you can view the counters
If the ratio of SYN to TCP is high (> 1:5), a SYN attack is underwayunit 0 { family inet { filter { output detect-syn-attack; } address 10.10.10.1/24; }
[email protected]# run show firewallFilter/Counter Packet count Byte countdetect-syn-attacktcp-packets 289144 86743200syn-packets 56388 16916640

Dealing with SYN AttacksStopping the attack is usually not an option. If the attack is not distributed, you can change the accept action to discard and apply to the ingress of all AS boundary routersIf the attack is distributed, filtering SYNs also effectively shuts down the serverTracing the attack requires co-operation with peers of the network under attackExamining the sampled output reveals incoming interfaceRepeat this process until the source is found

Infrastructure RequirementsSufficient forwarding capacity in times of stressLarge numbers of small packetsFiltering to detect and block attacksFilter on significant ICMP/IP/TCP/UDP fieldsImplement consistently on all interface types, including logical interfaces (eg VLAN)Sufficient performance to permit NOC to enableRate limitingRate limit based on significant ICMP/IP/TCP/UDP fieldsSufficient performance to permit NOC to enableSampling and logging for additional insight

Pro-active ApproachesMore reliable and secure networkPolicy at AS boundaries detect and minimize the effects of DoS attacksWarn NOCs when thresholds are exceeded, and update configurations using scripts to discard the attack
SwitchHostAttack

Proactive PlanningEstablish procedures for detecting security events
Pre-plan responseTechniques for isolating problem, tracking it through the network to a sourceStandard responses to alleviate impact to serviceTrain staff and practice
Document and update a security poli

Juniper Networks Customer Presentation

Text of Juniper Networks Customer Presentation

JUNIPER NETWORKS LEARNING PATHS · PDF file Juniper Networks Certified Associate Cloud (JNCIA -Cloud) Network Automation in the Service Provider Cloud (NASPC) Juniper Networks Certified

Juniper Networks Learning Paths - flane.de · PDF fileJuniper Networks Learning Paths. Juniper Networks Education Services. Revised November 2016. Professional. ... (JNCIS-SEC) Juniper

Delivering HPC Applications with Juniper Networks and ... · PDF fileTitle: Delivering HPC Applications with Juniper Networks and Chelsio Communications Author: Juniper Networks Subject

Upgrade Guide - Juniper Networks · PDF fileUpgrade Guide Release 6.3.0, Rev 02 Juniper Networks, Inc. 1194 North Mathilda Avenue ... Juniper Networks, the Juniper Networks logo,

QFX3500 Switch · PDF file 2019. 4. 8. · Juniper Networks Junos® operating system that is used by Juniper Networks EX Series Ethernet Switches, Juniper Networks routers, and Juniper

Juniper Networks NetScreen-5200/5400 - ... System config script Yes NetScreen ScreenOS software Yes Dimensions and Power Juniper Networks Juniper Networks NetScreen-5200 NetScreen-540

Juniper Networks – Junos Pulse Secure Access Service ... Juniper Networks – Junos Pulse Secure Access Service . Secure Access Service version 7.1R1 Build 17675 . Juniper Networks,

Copyright © 2007 Juniper Networks, Inc. Proprietary and 1 Juniper Security Threat Response Manager (STRM) Customer Presentation

Vertical Campus - Juniper Networks · PDF filethe Juniper Networks Vertical Campus tested design is based on Juniper Networks switching, wireless laN, and security products. It presents

Juniper Networks NetScreen

Ethernet Switching - Juniper Networks

RESTfulAPI - Juniper Networks · PDF file 2016-12-01 · RESTfulAPI - Juniper Networks ... get get

Juniper Networks Security Appliances Security ... Juniper Networks Security Appliances Security Target Revision L December 19, 2005 EAL4 5 • Juniper Networks NetScreen-204 (Part

Juniper Networks Learning Paths - flane.de · PDF fileJuniper Networks Certified Specialist SDN and Automation (JNCIS-SDNA) Juniper Learning Bytes Juniper Networks Certified Professional

Juniper Networks Data Protection Agreement Suppliers ... ... Juniper Networks Data Protection Agreement 03182020 3 Juniper Business Use Only Supplier shall provide Juniper Networks

Feature explorer juniper networks

Why Juniper Networks

Download - Juniper Networks

JNCIA Juniper Networks Certified Internet · PDF file Juniper Networks Technical Certification Program The Juniper Networks Technical Certification Program (JNTCP) consists of two

EX4500 Ethernet Switch - Juniper Networks · PDF file2 EX4500 Ethernet Switch Data Sheet Juniper Networks Services and Support Juniper Networks is the leader in performance-enabling

Juniper Networks Analysis

Network Field Day 10 - Juniper Networks Part 1: Juniper Networks Company Overview

Juniper Networks 2012 Corporate Citizenship and ... Total Juniper Networks Stockholders’ Equity (USD) $6,999 million Juniper Networks Foundation Fund Grants (USD) $1,791,057 about

Junos Genius - Juniper Networks · PDF fileJunos Genius is Juniper Networks ... Juniper Networks challenges the status quo with products, solutions and services that transform the

Applications of Bidirectional Forwarding Detection (BFD) · PDF fileTitle: Juniper Networks Presentation Template-US Author: Juniper Networks Keywords: Juniper Networks Presentation

‍±·¾€ »¸½µ¹¸ Juniper Networks

Presentación Juniper Networks

Ashley Juter Juniper Networks

The Impact of SDN On MPLS Networks Adrian Farrel Juniper Networks [email protected]

PCN Juniper Networks