Anti-DDOS

Reliability and stability

System safety

Optimal solution

Quick support

Anti-DDOS Volume Based is the solution to minimize bandwidth denial-of-service attacks that congest uplink traffic of clients and affect services or network leading to widespread service loss.

DDOS attacks have been increasingly diverse in scale and purpose, which are not merely acts of sabotage against systems for personal purposes but also organized attacks fueled by economic and political motivations. Types and scale of attacks are increasingly diverse and complex.

Hackers may use terminal errors, launch various types of attacks to mobilize high-volume attack streams ranging from a few Gbps to several tens of Gbps:

Types of attacks include UDP flood, ICMP flood, SYN flood, DNS Amplification, NTP Amplification, SSDP, etc…
Attacks may target a FTTH client, a Leasedline client, a business or even a network operator, etc…

Anti-DDOS Volume Based system is an all-in-one solution which protects users and organizations from the said DDOS attacks by blocking illegitimate traffic at the ISP’s network.

Why should choose Metfone service?

Detect and alarm high-bandwidth DDOS attacks to administrator via SMS or email.

Mitigate types of high-bandwidth attacks such as: UDP flood, ICMP flood, SYN flood, DNS Amplification, NTP Amplification

Process high-bandwidth attacks of up to several tens of Gbps, or illegitimate traffic of up to 10 million pps.

Detect and alarm attacks that congest uplink by each interface, process link congestion directly through portal

Operate and process in an easy manner

Implement easily and be compatible with a variety of network infrastructures

Feature

Detect DDOS Volume Based attack

Detect attacked IP based on client’s actual traffic profile for any anomalies. Detect attacked IP by threshold.
Types of attack detected: Volume based: UDP & ICMP flood, SYN flood, Volume-based regardless of protocol.
Detection time less than 2 minutes
Verify good IP list for the whole network and for each client (a reliable IP list that client regularly connects with a normal state)
Issue ACL (Access List) of attacked IP

Portal for monitoring and processing attacks

Monitor ongoing attacks: Detailed information of the attacks (IP, bandwidth, type of attack).
Process attacks: Route attacked IP to null/Scrubber. Modify the Access List of the attack.
Further monitoring: View the In/Out PCAP data packets if the attacked IP runs through scrubber to evaluate the effectiveness of detection/prevention.

Block 1 bad IP

Block quickly 1 bad IP and send order to Router RTBH.

Prevent DDOS Volume Based attack

Situation 1: Deal with direct attack stream on the portal: International link flood, Allot overload: send order to router RTBH to solve the attack.

Situation 2: Route the illegitimate traffic of DDOS attack to scrubber system to filter the illegitimate traffic, upholding service for clients:

Block invalid packet
Permit good IP: allow good IP to pass through quickly without further processing (ACL, bandwidth reduction), etc…
Drop bad ACL: block illegitimate traffic by ACL from Detection
Bandwidth limit by IP dest: Bandwidth limit by preset threshold
Capture PCAP data packets before and after processing for further monitoring
Deal with attack at max 20Gbps/01 physical server