now I'll hand over to Henrik
thank you very much
good morning everyone my name is
Budapest and CEO of the city and I'm
very happy to be at this conference for
the first time
my presentation is available as a PDF
and it's already on GitHub so if you go
to GitHub and use my nickname kamsa then
you can find it using activity as a
search term so it should be possible to
get this presentation
immediately if you like the presentation
also has some contact information for me
I'm just a network and security
consultant I have been working with
networks and security for our since the
early 90s I'm a huge fan of firewalls
and I would like to state that
immediately because I will be making
some comments about firewalls later on
but I'm a huge fan of firewalls I run a
small Network as 57 860 where I try to
implement some of this stuff and I
usually work from Denmark but I also
travel a lot and I have been around the
world in different places to do testing
and pin testing and building networks I
also like to enjoy the ripe conferences
and be part of the community like we do
at this event
and I will be around both today and
tomorrow so if you have any questions
later please approach me and ask them
so this presentation is about Security
on the internet and as you may know that
when you're connecting to the internet
we immediately receive traffic from
unknown sources we are immediately
getting scanned we are seeing the noise
on the internet the Internet teenages
it's kind of like a background noise
whenever we connect to the internet
and we should of course try to be
proactive and test our networks using
active penetration testing methods so
hopefully most of you will know that it
is very useful to do Port scanning it is
very useful to try to look at your
attack surface from the outside and that
is what this presentation is also about
so this talk will be about DDOS testing
your infrastructures on the internet I
will have an ultra short firewall
description what is a firewall because
that creates some problems for us when
we do the DDOS testing but it also
creates a problem for you when you are
under attack from DDOS sources so I will
be talking a little bit about doing Port
scans for discovery of infrastructures
because those will be the weak points
that we will be attacking then I will
follow up by some detailed advice how to
perform an active detail simulation so I
call it a simulation I do it I call it
Adidas test but I'm trying to mimic what
the attackers do to our Networks but
instead of having this chaotic attack on
your network where you don't really know
what's going on you don't know what kind
of traffic you're receiving we try to do
it in a more structured way so we can
see how the devices react and then what
kind of logs they lock how they actually
behave during an attack
so we try to do more structured DDOS
testing so that will involve running
various Tools in various circumstances
and with various options and I'm trying
to be very specific because a lot of a
lot of these tools have many many
options so I'm trying to lay out a
structure and how to actually perform a
minimal DDOS test and then you can get
creative afterwards and being evenly
creative sometimes is quite nice because
then you can try to protect your network
from these evil attacks afterwards and
when these evil attacks come and
unfortunately as we have seen in Denmark
and other places internationally we are
getting attacked we are getting attacked
all the time
so at the end of the presentation I will
have some advice for protection and
after the question slide my last slide I
will be presenting there's also going to
be some slides which have some pointers
to other references and other tools and
other methods for protecting so some of
the protection part is left out because
of time
these attack tools that I will be
talking about is mostly some that are
already developed some of them have been
around for many years
maybe you know them already but I have
added a few things of my own and I have
tried to update this presentation to be
kind of state of the art how we can do
DDOS testing ourselves with a low budget
so you don't need a lot of money to do
perform this but you can do it with
probably some of your existing
environment and you can also protect a
lot with your existing environment so
that's kind of the goal of today to get
you started on stuff that you can go
home and try out and you can improve the
security of your Networks
I also have some opinions about some of
these things and I don't mind telling
you about my opinions if it is my
opinion then you are free to disregard
it you may agree with me you may not
agree with me and I'm very very happy to
discuss and talk about networks and
package afterwards so approach me please
that would be fun
talking about the internet and details
we know that it is trouble I have taken
some of the statistics from some of
these reports we see these reports
quarterly yearly from different
companies in this case it's the one
called netscout where they say that we
have these large attacks we have these
decreases and increases sometimes it
goes up sometimes it goes down some of
these attacks are really really big when
we see these numbers when I see a number
like 612 gigabits per second
that's more than I have into my network
in Copenhagen if I see the number
453 million packets per second mpps is
millions of packets per second that's
more than my network can handle when we
see this we may think that oh no I
cannot protect from DDOS I'm going to
give up I cannot protect from the
largest attack so I'm not going to do
anything but actually I think that most
companies could actually do a lot with
the existing environment you already
have there are some things that we can
do to at least handle some of the low
level attacks we can see what kinds of
attacks we are receiving and then we can
perhaps ask our Network providers our
isps and some of them actually have
methods for us to use and
improve our network security by asking
them to turn away traffic for a certain
protocol turn away traffic for a certain
IP address so in some cases you may ask
them to
disregard a specific IP black hole route
a specific IP to help your existing
Network and the rest of the addresses to
keep them alive and keep their other
services alive so there are a lot we can
do even if these attacks are very very
large
for the purpose of security and network
security we usually use firewalls and I
guess that all of you in your
professional context will have a
firewall you will have a device that you
call a fireball you may have a cluster
you may have multiple firewalls but it
is some kind of collection of components
and I really love to point to different
references that it's not just a single
device it is some kind of device that
can fill the traffic it can pass through
the firewall if the base some kind of
local security policy but if it does not
match what is allowed in the firewall it
will get turned away or it may get
discarded thrown on the floor so when we
have a packet coming in we match it
towards a local policy if it matches and
we allow it we will pass it on but if we
do not allow it we will throw it away so
that's what a firewall basically does
and the most important parts is actually
the parts that it is allowing so what is
the firewall allowing that is the thing
that I would suggest that you focus on
also we would like to stress and we have
all of these zero trust networks and
stuff going around in the industry uh
using the terms inside and outside may
be a bit old and we cannot trust the
inside we cannot trust the outside we
cannot really trust anything today so we
have to consider attacks from all
sources inside and outside
if we go to Wikipedia they have a very
nice description saying it's a network
security system so it's not a network
security device that monitors and
controls incoming and outgoing Network
traffic based on predetermined security
rules so that is a firewall and to me a
firewall is definitely not a single
device it's not a single pump in The
Wire it's multiple devices
looking at a firewall from a vendor they
will have a device on the test which is
in the middle up here it is a place
where they can do stateful filtering
they can do screening they can do IDs
IDP IDP they can do various Security
Services antivirus TLS inspection
everything antivirus everything they can
do it in a single device and they will
optimize their device using a testing
device some kind of traffic generator
they will optimize the device for the
common use case
the common use case being TCP UDP stuff
like that is allowed through the
firewall they would like it to run full
wire speed so if it's a 10 gigabit
network card in the firewall it should
be able to pass 10 gigabits of network
traffic but can you really do all of
this in a single box
does it make sense to do all of this in
a single box it will become more complex
it will require more resources and I
really don't enjoy putting too much
stress on the firewalls especially since
they are sometimes using older CPUs
they're using older software they have
firmware which is updated as a single
file so if there's a bug in one part and
you need to update you wish you may
experience that you have problems in
another part another feature in the
firewall that starts to act in another
way needs to be configured in another
way or maybe some features going away in
the new firmware so there's a lot of
problems by having a single device
firewall
foreign looking at a firewall in the
Enterprise mindset we usually have a
firewall connecting us to the Internet
so we will have the internet being our
traffic generator it's not everything
that we want to have generated that is
coming to our network but we see a lot
of traffic coming we also have a secure
land some people may consider their
inside a secure Lane but it may be a
huge network with lots of devices and
usually you don't even know what you
have on the inside and then you may have
some monitoring on your devices and I
highly suggest that you do more
monitoring in your networks because then
you will know more about the traffic
flows that you should allow the traffic
flows that earn you money that are being
used for services in production so your
infrastructure is based on multiple
components and devices in front of the
firewall we have something behind the
firewall we have something and that is
something we need to secure and we use
the term defense in depth and I really
enjoy looking at all the devices looking
at all the components and you should try
to secure everything so looking at a
Network drawing like this one it's not
the as a specific customer it's intended
as a generic Network drawing of all the
devices that we have from the internet
going all the way to the servers at the
bottom so we have lots of different
devices on the traffic flow way on the
route from the internet and then we have
all of these attacks from the internet
we have low level attacks we have high
level attacks and we want to protect
everything without losing functionality
and we don't want to have an
administrative nightmare so that's the
next part we also must consider when we
start going into this later on
what I am talking about when I say DDOS
and especially for this presentation I'm
talking about various attacks that use
up some resource so it's using up some
memory space interrupt processing CPU
processing bandwidth TCP State firewall
state number of concurrent sessions
anything that can use up a resource is a
denial of service when we talk about a
distributed denial of services or
multiple sources on the internet but in
this case in our structure testing we
use a single device usually to produce
this traffic and of course we can start
spoofing lots of sources so it would
look like a real distributed denial of
service but a denial of service is
anything that uses of resource and
resources are limited they are always
limited there will be bottlenecks in
your network and the goal is to
configure your systems so you have as
few bottlenecks and they are as high as
possible so or you can produce a lot of
production traffic looking at the
firewalls just quickly
this is the traffic processing on an SRX
series from junipa it's just an example
of a network device that you can buy it
has this per package stuff that happens
on the left then it matches the session
usually we do stateful filtering then it
goes to the small the flow on the right
bottom or it goes through the long one
at the top where it goes through a lot
of different steps so this is what
happens for each packet received on an
SRX firewall and as you can see there's
lots of different parts and I'm not
going to go into details but this is
what must happen for each packet going
in going through going out of this type
of firewall and you could find similar
ones from the other firewall vendors
this is just what I happen to use you
usually so I know this one better
looking at these firewalls we also know
that they usually have a control plane
and a data plane they will typically in
the higher speed versions have some
Hardware supporting the usual and the
common case so the data plane will be
Hardware which is designed and optimized
for some use case
then we will have a control plane which
will be the configuration stuff you will
log into the control plane you will
change the configuration you will push
these changes into the fpgas into the
networking chips the routing chips
everything that goes on in the data
plane if something happens to go all the
way up to the control plane it will be
handled by a CPU process so that will be
limited in what the CPU can do whereas
the data plane usually will do things in
hardware and actually can perform a lot
of stuff in Hardware in modern devices
even the ones that I buy for my company
which are the smallest devices mostly
for 10 gigabit gigabit routing typically
also when we have a network we will have
what is called a link in it and a
hosting Network so we will have the
services that you published to the
internet on the production Network the
hosting Network in my case and then it
will have a link net connecting the
devices this linknet could also get
attacked so I
recommend that you do Port scanning and
Discovery and testing on these devices
too typically they would be a very small
Network like a slash 28 26 and then the
hosting Network where you have your
services will be as less 24 or slash 22
000 addresses if you have them and then
we have the similar ones in IPv6 and it
is recommended to have a small link
Network and then you would probably have
a slash 48 for IPv6 for the hosting
parts and you can get that from Ripe you
can get provider independent addresses
so you can move them between isps and
you can have multiple isps and I
recommend that you get IPv6 provider
independent Pi addresses immediately
start applying for that through a li
local internet registry
since you are security people at this
conference I guess you know in map the
port scanner so I'm going to go through
very quickly the parts that I recommend
you do before the testing you will use a
port scanner and that will show which
ports are open the ports that are open
are of course the ones that we want to
check these are the
ones that will create state in the
devices all the way to the servers
you would in the best case have
something that you can ping and then you
would have a CCP port and then a UDP
Port some kind of service that runs on
TCP some kind of service that runs on
UDP so that would be the Baseline for
doing this testing and then I would
recommend doing some monitoring make
sure that you have nice green graphs
showing that there are no service
problems
everything is green everything is ready
for the testing if you have an unstable
service it's not nice to test but if you
have a green all the way 100 uptime for
the last week and you start attacking
and you see that this breaks then you
know that it was the testing that made
it break
I usually use nmap to do the port scan
and then afterwards when I have found
these services to attack I will use the
tools like hping 3 and t50 in penguin
ping and penguin ping is my own script
which is a small add-on which I have
released for this conference because I
was going here I put it public on my
GitHub I put the web page up with some
text and descriptions and hp3 to 50 are
on clearly already and you can very
quickly and easily install DP DK data
plane development kit from insole
originally but it's now open source and
then you could run penguin Ping On Top
of a Kaylee or a Debian
then using these tools I would go
through all the scenarios that I usually
see on the internet being DDOS attacks
so that would be sun floating it would
be UDP flooding icmp flooding all of
these flooding attacks I would go
through all the scenarios I would
register all the changes to the devices
in the network and I would expect things
to break and usually when we do this
breakage it will be different scenarios
breaking in different networks depending
on the devices and their configuration
but afterwards we will investigate and
that's not part of the presentation
today but you should investigate is this
scenario something that could hurt our
network is it something we can turn away
so it doesn't affect our network if
somebody tried to attack it and usually
you will be able to remove at least some
of these use cases without losing
functionality
the problem with all these tools the
nmap hping t50 is that they have a lot
of options so which options should you
use for these testing structure testing
a small hint I usually save the IP
addresses in a variable on the shell so
if I'm on a command line I usually do
this from the command line I will save
the IP addresses in a variable because
then if I mistype the variable nothing
bad happens if you type the IP address
in the middle of the night and you
mistype an IP address you are performing
a DDOS on somebody else so better save
the IP addresses as a variable and then
you can use this in your nmap command
and you can use it later on in the hping
3 and t50 and so on so a small hint to
avoid attacking other people on the
internet we don't want to do this I want
you to use this for good stuff
then I also have a small other hint
which is to add the last line where we
have the date so having a date separated
with
the H ping command and then using the
time in front of the H ping that will
make sure that if you do a lock of all
the commands during the night you will
have ping3 with a Ctrl C it will see how
many minutes how many seconds you ran
the command so doing a complete log of
your command line and have date time
stamped when you started an attack and
for how long you ran an attack and you
can match that up with your locks
afterwards making sure that your locks
are of course timestamped two with the
correct time
my goal when I do this nmap is to
enumerate all the ports that are allowed
through the network I will save all
these files I will output it into an
ipv4 IPv6 I will making sure that I can
find something to attack doing the port
scan part should not break anything if
you have stopped that stuff that breaks
and dies then it is vulnerable to normal
traffic so that would be something to
fix first that's really bad if something
breaks because of an end map
also to some operating system detection
I would also like to do service scanning
and one of the services that I usually
find on the customer routers the ones
from the isps is the SNMP protocol which
allows me sometimes to see that a router
in a customer network has been up for
more than 700 days
so if a device has been up for more than
700 days what is the firmware is that a
recent firmware on that device or is it
definitely going to have some bugs and
definitely there is some box in this
case it's a Cisco device and a Cisco
device that hasn't been updated for two
years or more is definitely vulnerable
to something so that's also things that
come out of this testing when you start
to investigate your network you will see
different things that you can also fix
before doing the DDOS testing and before
somebody attacks your network
then moving on to these packet
generators this hping 3 is very flexible
it's very nice it can increase and
decrease the speed which is very
important when you start to see things
breaking because you want to know what
broke which device broke so you don't
want to run it with full 10 gigabit
network speed you want to run it perhaps
with one gigabit 2 gigabit see where it
breaks Run 1 million of package per
second run two millions of packets per
second and see when stuff starts to
break and sometimes when we run these we
also monitor the devices and see if the
CPU load goes to 50 if we load it with 1
million packets per second then would it
break if we put it down to 2 million
probably and when we put it on 2 million
we see go close to 100 and then we know
kind of the rate of attack which will
break this network these devices these
specific devices so hp3 is a very nice
tool and usually you can produce a
million package second from a single
process and you can run multiple process
on your Kaylee Linux usually our
machines today have multiple CPU cores
so hp3 is a nice tool has a lot of
different options the one called t50 has
the same options and can produce the
same attacks but it also have a
specialized protocol t50 option which is
very nasty because it then it starts to
send all protocols sequentially so a
firewall that is optimized for TCP UDP
icmp receiving all sorts of protocols
all sorts of traffic makes it go into
all of these cases and special cases
putting some of the load into the CPU is
really really bad I can tell you that
when I start using this command usually
the firewall will start to break and
will get overloaded especially if you do
it at a high speed in millions of
packets per second
then we have the penguin pink packet
generator I found a library called lip
Moon which is part of moon gen which is
a packet generator based on the dpdk
from Intel originally it's now open
source using this tool I can write Lewis
scripts and these Lewis scripts allow me
to re-implement in about 230 lines of
lure code the same options s h ping3 the
difference is where a single process
could run like a million packets per
second a single CPU core with this tool
using Moon gen can produce
14.8 million package per second which is
the full 10 G wire speed from a single
CPU core on a small device with a cheap
network card so that's really really
fast and it also has a nice option minus
r so we can ask how much to generate
so the process using these tools would
be to monitor the network attack break
and repeat so we would start out small
with small attacks see how the network
reacts see how far the packets get into
the network they pass the first router
from the ISP they hit the firewall the
firewall will get loaded a bit we will
see how it handles different kinds of
traffic and then usually it will start
to break at some point and I advise you
to go through all of these scenarios
first do not make changes during the
testing because you may optimize for one
use case and then later on for another
use case which may affect the previous
use cases so better to go through all of
the scenarios mark down the ones that
failed try to fix those and then do a
retest on another night and usually I do
it during night to avoid production
issues
this is the command to run the hping 3
as you can see I have exported the
custom IP as a variable so I can use it
further down in the tools I am using the
date command to get the nice timestamp I
have the time command which summarizes
the time I only ran this attack for one
minute and seven seconds I was very
impatient that day just trying to
produce some output for this
presentation and this is the way that I
start out by doing a soon attack soon
floating attack on Port 80 which is of
course one of the common ports so Port
80 HTTP would be a common CCP port to
attack and this is very nice because you
can run this multiple times at the end
of this command up here we have the
Ampersand which means this runs in the
background so I can just use my arrow up
and enter Arrow up and enter Arrow up
and enter and start perhaps five or four
six seven even perhaps eight if I have a
new CPU so I can put a lot of load on
the network work and it's very flexible
it can do just about anything you can
control any part of the packet using the
HP 3 tool
my recommendation is to run each test
for at least five minutes or even 15
minutes A lot of these attacks require
some build up if you have a timeout in a
firewall for instance a juniper SRX at
one point at
1800 seconds timeout for UDP sessions so
if you creating a UDP session it would
take 1800 seconds without any traffic
for it to time out so if we ran a short
attack it might be able to handle the
burst but if we wait for some more time
it may be that this table of UDP
sessions ran out of space and then it
would not be able to accept any more UDP
sessions on that device so this is why I
run this for up to 15 minutes if we
don't have any change that's nice then
it's a pass but any changing response is
a result so if you have a higher latency
stuff answers slower if you have probes
that are lost that's a result if you
have lots of connectivity to the device
that's a result and sometimes you have
to monitor all the devices to see if
there's a change if there's a change
then I recommend that you stop the
attack see everything go green and then
retest using the same parameters to see
if it really is this attack that breaks
it and then you can confirm
approximately the level where it breaks
and you can try to turn it up a bit turn
it down a bit see where the approximate
level is and that becomes important
because after you have tried to make
changes then you can perhaps run with a
much higher level so we have seen in
some use cases and some scenarios that
we have improved the the level several
hundred percent at one point I had a
firewall at a customer it was vulnerable
to 50 000 packets per second 50 000
packets per second is something that I
could probably produce on my phone using
14 networks so it's a very small attack
size and afterwards they could handle
millions of packets per second with the
same scenario so it becomes important
important when you want to demonstrate
that you have improved your environment
yes I think I have said everything here
these are the basic tests that I
recommend that you do they are
implemented in all the tools this would
be a basic test so that would actually
go through a lot of different variants
of the attacks that we see on the
internet we do it structured so we do it
one by one but an attacker would
probably mix up these they would send a
burst of this and a burst of that or
even mix it at the same time and of
course after doing these sequentially it
would make sense to try to do the mixed
and if you can mix it all up in a random
fashion and your network still survives
that's a good thing
so using me my tools hp3 or the penguin
ping with these options then you would
be able to do these soon sunak icmp UDP
flooding and it is quite easy to perform
this
use the usually when I run these tests I
use the tool if PPS to show the
interface package per second on my
device as I'm sending the traffic so I
can see how much am I sending but you
can also monitor your local switch your
local router all of these routing
devices switching devices have methods
for monitoring a port seeing how much
traffic you are sending and how much
traffic you're receiving
usually I would also tune this test
making sure that I not always run with
the full speed because we want to find
out which devices break and then we can
turn it up to floating at the end so
don't start out by floating everything
because then it will just break
it's more interesting to see when it
breaks and see what kind of thing in the
device breaks is it because of the
interrupt handling is it because of
these State tables is it something that
we can actually fix or improve by the
configuration so don't just turn it up
to flooding even though it's quite fun
to plot stuff
using the hp3 and the DDOS testing tools
I would also advise that you try to
attack some of the network devices the
router usually a router could have
something like the secure shell running
should not be open to the whole internet
so by demonstrating that you can make it
break or make it high load High CPU load
then you can ask people to turn it off
afterwards using something like a router
protection filters it's something that
should be implemented on all routers
servicing your network so only the ISP
can log into that router using SSH and
if it's running pgp the routing protocol
that's actually a TCP service running on
179 and you can also try to attack that
one and we have seen networks becoming
coming offline because we attack the
router in front of the network so it's
not only your part the part that you
control but you must ask your ISP to
also improve their Network a bit and it
is called router protection filters
I told in the in the title for this that
IPv6 testing is also part of this and my
favorite tools have not supported IPv6
and I'm a very fond of IP version 6 I
did my thesis in Copenhagen 20 years ago
about IPv6 nobody uses ipd6 in Denmark
but I would like to test using IPv6
and since these tools did not support
IPv6 but these tools were open source I
could actually take the hp3 tool then I
could put it on GitHub I could replace
all the references to ipvision 4 with IP
version 6 and I actually even though I'm
a bad programmer I could actually do a
version that supported IPv6 but even
better the new tool that I have created
the script that I created on top of this
Moon gen uses Lua and it already
implements IPv6 so now I can use a small
script in Lua I can modify and customize
this script and that is my preferred way
of doing IPv6 testing and basically the
testing process is the same the main
difference is that we cannot do an nmap
full scan of a network because subnets
in IPv6 are quite large so it is
required to look into the firewall
configuration the server configuration
and see which ports are open to find the
open ports Maybe it's within the first
100 IPS if it's statically allocated but
when you have the the services and the
ports available
then you can definitely use these tools
either the old hping from 2018 that I
created which is kind of a bad just
replaced all the
all the references to IP version 4 with
IPv6 but it's much better to use this
Moon gen from this person Emory P from
GitHub
and there's also some other test cases
usually I don't spoof my source usually
it's very nice to see in the logs that
we have a specific IP address scanning
us testing us dosing us we can look into
the logs find my IP and see what goes on
but definitely you want to try spoofing
and it is implemented in all these tools
that I have told you about
there's also nice evil features like
this one with which is about fragmenting
packets so if you have a fragment of a
packet then the firewall device the
secure devices they have to wait for the
rest of the fragments and guess what
these tools do not send the rest of the
fragments so the firewall will spend
time keeping and storing these fragments
until they time out so again some of
these features built into the tools are
very nice for breaking the devices
if we start to attack a network and have
the monitoring running we can see
there's a large green line at the start
and then it starts to break this is from
a tool called smoking which I really
enjoy because it does multiple probes
and then it records the results in color
so the color blue on the first one here
says that it's losing some probes one
two three probes and then it gets even
worse because the color changes so it
loses more probes and usually you would
be sending 20 probes per minute and
seeing which ones that are not responded
to when we go further on in this case in
this test we see that it goes into red
being red means that the service is
definitely offline it has 19 to 20
probes lost so there's no service on
this service that is being tested and
that is what the customers of this web
shop or production site Production
Service would see
we can go on and retry the test so we
see a small green part after 11 and then
we retest and see that it really indeed
goes bad with this scenario so in this
case it was a spoofing attack and it
also worked and I as I remember I
spoofed the IP addresses of the network
itself which should not come from the
internet so maybe look into the
configuration and do not allow your IPS
to be the source of traffic from the
internet that's kind of that seems bad
so turn that traffic away
using the tools that I have mentioned
already we can do a maximum speed test
we can do the full 10 gigabit and 14.8
mil 8 million packets per second that is
actually the maximum number of packets
with the minimal size on a 10 gigabit
connection so it's not as much about the
bandwidth handling because usually these
firewalls can handle large packets data
transfers but if you try to send the
smallest packets it goes bad because
every packet must go through this long
flow of traffic all the package steps
within the devices so handling 14 15
million packets per second is really
really hard in the device so usually
they will sell you a device that cannot
handle this but they will handle some
kind of imix some kind of mixed traffic
with large packets foreign these modern
CPUs that we have for many years support
methods for sending and receiving high
speed using this lure it is using Lua
jit which is just in time compiled
making it a small Loop which can run
very efficiently in our modern CPUs the
modern CPUs are connected with the
network cards using for instance this
data plane development kit it was
originally from Intel so most of the
cards supported are from Intel but there
are also other vendors and other cards
supported by this and it is open source
so you can buy one gig cards 10 gig
cards 40 gig cards and you probably
shouldn't try to buy 100 G cards and
produce a packet DDOS testing traffic I
would rather have a number of smaller
cards and maybe a switch to aggregate so
if you wanted to produce say 100
gigabits full capacity then you would
have a switch with 100 Gig and then 10g
or 40G and then set into traffic and
then allow the switch to aggregate it
into a full 100 gigabit and that would
certainly be possible by just having
perhaps 10 machines or fewer
I'm using a very small device and this
is not a recommendation of Dell it just
happens to be the device that I could
get for pretty cheap it's not very big I
can travel with it I have it in my hotel
room I set up this small testing
environment with a small 10g switch and
it's just any modern new CPU would
probably work then you would look into
having a PCI times eight a slot and then
I use an old Intel card which is
something you can find on eBay pretty
cheaply
using the tool that I have used on top
of this Moon gen allows me to produce as
we can see in this case 14.8 million
packets per second which is not full 10
G so it's only 7.6 so looking at a graph
you may think that oh my device can
handle 10g but it is actually not 10g in
bandwidth but it's 10t in packets per
second
this tool can be used for UDP icmp it
can be used for just about any protocol
you wish because it's written in Lua
there's a lot of Lua scripting
implemented already you could add your
own protocol I have messed with this and
again I'm not a great programmer but
very very quickly you can start to
generate whatever kind of traffic you
want and you can actually create it in
full wire speed mode
I'm just going to go a little bit
quicker just saying that this is
comparable to real DDOS it's very very
approximate to what I have seen in real
life networks that I have been running
and I see a lot of different uh
results from this and the results is
that we should do more packet filtering
so my recommendation is to look at all
your devices from the internet all the
way to your servers looking at these
devices we can actually do specific
stuff at specific points and a lot of it
can happen in Hardware so looking at a
router it can do stateless filtering of
individual packets so if you know that
there are some protocols that you're not
using you can turn it away by the router
if you want to shape and do some
distribution you want to allocate a
specific bandwidth number for a specific
protocol you can do that in your routers
and switches then we can see the
security services security devices what
you usually would call a firewall would
handle less traffic and that is actually
the goal of the projection that I'm
advising start to use the features
already available and I can see my time
has run out now but I'm just going to to
quickly point you to these slides where
I have taken a design approach saying
that for some protocols we may need full
changing but for some other protocols we
will need less so if we need less why do
we allow more into the network and by
going further we can look into the
specific ports that are available we can
look into the configuration statements
this is from junos where I have limited
icmp to 100 megabit because nobody wants
10g of icmp traffic into their Network
so better turn it away before it reaches
the firewall device which needs to
handle it in all of these steps that we
already have seen and UDP one gigabit
because usually we don't have more than
a few hundred megabits depending on your
use case and your network some networks
use file transfer using UDP and they
will definitely need more but in a
common Network you can use configuration
statements like these and you can find
them for your own devices in your own
network and if we do this we can see
that kind of like in this case a 3.5
gigabit network attack and it resulted
in only 350 megabits being sent on to a
one gigabit firewall
I will
unfortunately have to stop now time has
run out so before I get the dragged off
I will be here for today and tomorrow
very happy to answer questions go to
GitHub find the presentation if you like
and thank you very much for allowing me
to talk about this subject
foreign
thank you very much