Massive DDoS Attack Generates 500 Million Packets per Second

Distributed denial-of-service (DDoS) attacks do not have to be bandwidth-intensive to be disruptive and hard to mitigate.

Earlier this month, Imperva mitigated an attack against one of its clients that exceeded 500 million packets per second, making it possibly the largest DDoS attack by packet volume ever recorded.

The January 10 attack was a so-called SYN flood, in which an attacker attempts to overwhelm a target computer by sending it TCP connection requests faster than the machine can process them. In this case, the attacker sent both a flood of normal SYN packets and a large SYN flood, involving packets of between 800 and 900 bytes, at the target using a highly randomized and likely spoofed set of source ports and addresses, according to Imperva.

Attackers often combine these attacks so regular SYN packets exhaust server resources like the CPU, while the larger packets saturate the network, the vendor has previously noted.

Imperva's investigation of the January attack showed it was launched using two previously known tools — one for the flood of regular SYN traffic and the other for the large SYN attack. The tools appear to have been written by two different individuals and then used in a combined fashion to "launch the most intensive DDoS attack against network infrastructure in the history of the Internet," Imperva said in a report this week.

Businesses and the media often tend to focus on the size of DDoS attacks, says Tomer Shani, a security researcher at Imperva. "In reality, size isn't the best reflection of how difficult attacks are to mitigate or how damaging they can be," he says. "Packets per second (PPS) is actually a better indicator."

An attack directed at GitHub last year that generated peak traffic of some 1.35 terabits per second is considered one of the largest bandwidth-intensive DDoS attacks ever. The attack garnered a lot of attention at the time and has often been used as an example of the enormous challenges posed by large DDoS attacks.

Mitigation Challenges
But from a mitigation standpoint, provisioning enough network bandwidth can blunt such attacks. DDoS mitigation and protection services these days tend to provision network bandwidth that is far greater than the largest observed DDoS attacks, Imperva said. This has made the sheer volume of an attack less of an issue, according to the vendor.

Dealing with attacks involving very high PPS, on the other hand, is harder because of the compute processing power required to evaluate every packet. Often the limiting factor for the network routers, switches, and mitigation appliances that service providers use to mitigate DDoS attacks is the packet rate and not the packet size, Imperva said in its report. Mitigating high PPS attacks require significantly more processing capabilities than available on most of the network appliances that are used to route or switch a packet, the vendor noted.

"Organizations provision for capacity, so that's why size is the standard metric when measuring DDoS attacks, but organizations should be more concerned about attacks with high PPS," Shani says.

In the GitHub attack, for instance, the DDoS traffic consisted mainly of large packets sent from the same port from different servers at a relatively low PPS rate of around 129.6 million. In comparison, the attack that Imperva encountered this month involved nearly four times the volume of packets being sent from random sources.

"High PPS attacks are harder to generate because they require more compute resources, in the same way they take more compute resources to mitigate," Shani says. "Organizations should be more concerned about attacks with high PPS."

Ashley Stephenson, CEO of Corero Network Security, says the impact of a DDoS attack ultimately depends on the vector and the vulnerability of the targeted organization. In the right circumstances, both high bandwidth and high PPS DDoS attacks can be equally devastating. "It is not possible to predict in advance how a multivector DDoS attack will evolve," he says. Different vectors deliver different mitigation challenges.

For instance, "high PPS attacks do not saturate links as frequently as high [bandwidth] attacks," Stephenson says. "High [bandwidth] attacks often cause more collateral damage to innocent bystanders as they are crowded out by the resulting congestion."

Related Content: